From: Matthew Garrett <matthew.garrett@nebula.com>
To: linux-kernel@vger.kernel.org
Cc: linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
Matthew Garrett <matthew.garrett@nebula.com>
Subject: [PATCH 01/15] Secure boot: Add new capability
Date: Mon, 28 Jan 2013 11:42:25 -0500 [thread overview]
Message-ID: <1359391359-25783-2-git-send-email-matthew.garrett@nebula.com> (raw)
In-Reply-To: <1359391359-25783-1-git-send-email-matthew.garrett@nebula.com>
Secure boot adds certain policy requirements, including that root must not
be able to do anything that could cause the kernel to execute arbitrary code.
The simplest way to handle this would seem to be to add a new capability
and gate various functionality on that. We'll then strip it from the initial
capability set if required.
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
---
include/uapi/linux/capability.h | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/capability.h b/include/uapi/linux/capability.h
index ba478fa..7109e650 100644
--- a/include/uapi/linux/capability.h
+++ b/include/uapi/linux/capability.h
@@ -343,7 +343,11 @@ struct vfs_cap_data {
#define CAP_BLOCK_SUSPEND 36
-#define CAP_LAST_CAP CAP_BLOCK_SUSPEND
+/* Allow things that trivially permit root to modify the running kernel */
+
+#define CAP_COMPROMISE_KERNEL 37
+
+#define CAP_LAST_CAP CAP_COMPROMISE_KERNEL
#define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP)
--
1.8.0.2
next prev parent reply other threads:[~2013-01-28 16:42 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-01-28 16:42 [PATCH 00/15] Secure boot policy support Matthew Garrett
2013-01-28 16:42 ` Matthew Garrett [this message]
2013-01-28 16:42 ` [PATCH 02/15] SELinux: define mapping for new Secure Boot capability Matthew Garrett
2013-01-28 16:42 ` [PATCH 05/15] PCI: Lock down BAR access in secure boot environments Matthew Garrett
[not found] ` <1359391359-25783-1-git-send-email-matthew.garrett-05XSO3Yj/JvQT0dZR+AlfA@public.gmane.org>
2013-01-28 16:42 ` [PATCH 03/15] Secure boot: Add a dummy kernel parameter that will switch on Secure Boot mode Matthew Garrett
2013-01-28 16:42 ` [PATCH 04/15] efi: Enable secure boot lockdown automatically when enabled in firmware Matthew Garrett
2013-01-28 16:42 ` [PATCH 06/15] x86: Lock down IO port access in secure boot environments Matthew Garrett
2013-01-28 16:42 ` [PATCH 14/15] MODSIGN: Import certificates from UEFI Secure Boot Matthew Garrett
2013-01-28 16:42 ` [PATCH 15/15] MODSIGN: Always enforce module signing in a Secure Boot environment Matthew Garrett
2013-02-17 19:19 ` [PATCH 00/15] Secure boot policy support Yves-Alexis Perez
2013-01-28 16:42 ` [PATCH 07/15] ACPI: Limit access to custom_method Matthew Garrett
2013-01-28 16:42 ` [PATCH 08/15] asus-wmi: Restrict debugfs interface Matthew Garrett
2013-01-28 16:42 ` [PATCH 09/15] Restrict /dev/mem and /dev/kmem in secure boot setups Matthew Garrett
2013-01-28 16:42 ` [PATCH 10/15] acpi: Ignore acpi_rsdp kernel parameter in a secure boot environment Matthew Garrett
2013-02-17 9:00 ` Dave Young
[not found] ` <CABqxG0cJGp7UEREvMW49QA0BfDXPsyEbAuMMLZwcHPdUAKT+Dw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2013-02-20 13:39 ` Josh Boyer
2013-01-28 16:42 ` [PATCH 11/15] Add EFI signature data types Matthew Garrett
2013-01-28 16:42 ` [PATCH 12/15] Add an EFI signature blob parser and key loader Matthew Garrett
2013-01-28 16:42 ` [PATCH 13/15] MODSIGN: Add module certificate blacklist keyring Matthew Garrett
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1359391359-25783-2-git-send-email-matthew.garrett@nebula.com \
--to=matthew.garrett@nebula.com \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox