From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pavel Machek Subject: Re: [GIT PULL] Kernel lockdown for secure boot Date: Mon, 9 Apr 2018 00:00:30 +0200 Message-ID: <20180408220030.GC4965@amd> References: <20180404125743.GB16242@thunk.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="CblX+4bnyfN0pR09" Return-path: Content-Disposition: inline In-Reply-To: <20180404125743.GB16242@thunk.org> Sender: linux-kernel-owner@vger.kernel.org To: "Theodore Y. Ts'o" , Matthew Garrett , Linus Torvalds , luto@kernel.org, David Howells , Ard Biesheuvel , jmorris@namei.org, Alan Cox , Greg Kroah-Hartman , Linux Kernel Mailing List , jforbes@redhat.com, linux-man@vger.kernel.org, jlee@suse.com, LSM List , linux-api@vger.kernel.org, Kees Cook , linux-efi List-Id: linux-api@vger.kernel.org --CblX+4bnyfN0pR09 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi! > > What I'm afraid of is this turning into a "security" feature that ends = up > > being circumvented in most scenarios where it's currently deployed - eg, > > module signatures are mostly worthless in the non-lockdown case because= you > > can just grab the sig_enforce symbol address and then kexec a preamble = that > > flips it back to N regardless of the kernel config. >=20 > Whoa. Why doesn't lockdown prevent kexec? Put another away, why > isn't this a problem for people who are fearful that Linux could be > used as part of a Windows boot virus in a Secure UEFI context? >=20 > If lockdown simply included a requirement for a signed kernel for > kexec --- and if kernel signing aren't available, to simply not alow > kexec, wouldn't that take care of this case? >=20 > This wouldn't even be all that much of a burden for non-distro users > with lockdown enabled, since in my experience outside of enterprise > and data center use cases, kexec isn't used --- and in fact, very > often kexec doesn't even work outside of a very carefully selected and > bug-fixed set of device drivers. (It often doesn't work in non-distro > kernels because very few upstream developers really care about kexec.) I do have Motorola Droid 4 here (cellphone). It uses safestrap.. and than it turn kexec's a lot (so that you can select Android vs. Jolla vs. ... during boot). So yes, kexec shows even in unexpected places. And BTW.. the cellphone thingie is a situation where manufacturer works against it users. Motorola does _not_ want me to run my own kernels here. Pavel --=20 (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blo= g.html --CblX+4bnyfN0pR09 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlrKkP4ACgkQMOfwapXb+vLuTQCeMDzahlxtiWb+VZ8CP3Jf2Hqu XcQAn2whnLxOBGlx1Qn+icDsL2hhrHIX =WLuA -----END PGP SIGNATURE----- --CblX+4bnyfN0pR09--