From: Matthew Garrett <matthew.garrett@nebula.com>
To: linux-kernel@vger.kernel.org
Cc: linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org
Subject: [PATCH 00/15] Secure boot policy support
Date: Mon, 28 Jan 2013 11:42:24 -0500 [thread overview]
Message-ID: <1359391359-25783-1-git-send-email-matthew.garrett@nebula.com> (raw)
Secure boot makes it possible to ensure that the on-disk representation of
the kernel hasn't been modified. This can be sidestepped if the in-memory
representation can be trivially altered. We currently have a large number
of interfaces that permit root to perform effectively arbitrary
modifications to the kernel, so this patchset introduces a new capability
("CAP_COMPROMISE_KERNEL") that controls whether or not these features are
available. The aim is for this to be useful in any other situations where
kernel integrity can be assured by some other mechanism rather than special
casing UEFI.
next reply other threads:[~2013-01-28 16:42 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-01-28 16:42 Matthew Garrett [this message]
2013-01-28 16:42 ` [PATCH 01/15] Secure boot: Add new capability Matthew Garrett
2013-01-28 16:42 ` [PATCH 02/15] SELinux: define mapping for new Secure Boot capability Matthew Garrett
[not found] ` <1359391359-25783-1-git-send-email-matthew.garrett-05XSO3Yj/JvQT0dZR+AlfA@public.gmane.org>
2013-01-28 16:42 ` [PATCH 03/15] Secure boot: Add a dummy kernel parameter that will switch on Secure Boot mode Matthew Garrett
2013-01-28 16:42 ` [PATCH 04/15] efi: Enable secure boot lockdown automatically when enabled in firmware Matthew Garrett
2013-01-28 16:42 ` [PATCH 06/15] x86: Lock down IO port access in secure boot environments Matthew Garrett
2013-01-28 16:42 ` [PATCH 14/15] MODSIGN: Import certificates from UEFI Secure Boot Matthew Garrett
2013-01-28 16:42 ` [PATCH 15/15] MODSIGN: Always enforce module signing in a Secure Boot environment Matthew Garrett
2013-02-17 19:19 ` [PATCH 00/15] Secure boot policy support Yves-Alexis Perez
2013-01-28 16:42 ` [PATCH 05/15] PCI: Lock down BAR access in secure boot environments Matthew Garrett
2013-01-28 16:42 ` [PATCH 07/15] ACPI: Limit access to custom_method Matthew Garrett
2013-01-28 16:42 ` [PATCH 08/15] asus-wmi: Restrict debugfs interface Matthew Garrett
2013-01-28 16:42 ` [PATCH 09/15] Restrict /dev/mem and /dev/kmem in secure boot setups Matthew Garrett
2013-01-28 16:42 ` [PATCH 10/15] acpi: Ignore acpi_rsdp kernel parameter in a secure boot environment Matthew Garrett
2013-02-17 9:00 ` Dave Young
[not found] ` <CABqxG0cJGp7UEREvMW49QA0BfDXPsyEbAuMMLZwcHPdUAKT+Dw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2013-02-20 13:39 ` Josh Boyer
2013-01-28 16:42 ` [PATCH 11/15] Add EFI signature data types Matthew Garrett
2013-01-28 16:42 ` [PATCH 12/15] Add an EFI signature blob parser and key loader Matthew Garrett
2013-01-28 16:42 ` [PATCH 13/15] MODSIGN: Add module certificate blacklist keyring Matthew Garrett
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1359391359-25783-1-git-send-email-matthew.garrett@nebula.com \
--to=matthew.garrett@nebula.com \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox