From mboxrd@z Thu Jan 1 00:00:00 1970 From: mjg59@google.com (Matthew Garrett) Date: Wed, 04 Apr 2018 16:42:20 +0000 Subject: [GIT PULL] Kernel lockdown for secure boot In-Reply-To: References: <24353.1522848817@warthog.procyon.org.uk> <20180404135251.GD16242@thunk.org> Message-ID: To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org On Wed, Apr 4, 2018 at 9:39 AM Andy Lutomirski wrote: > On Wed, Apr 4, 2018 at 9:22 AM, Matthew Garrett wrote: > > If you don't have secure boot then an attacker with root can modify your > > bootloader or kernel, and on next boot lockdown can be silently disabled. > This has been rebutted over and over and over. Secure boot is not the > only verified boot mechanism in the world. Other, better, much more > auditable, and much simpler mechanisms have been around for a long, > long time. Right and if you *know* that you're in that situation then you either turn it on in bootparams from the verified bootloader (which we can't do in UEFI because the *firmware* can be the bootloader thanks to the EFI boot stub) or you enable it from userland later (I can't remember if this version of the patchset provides that functionality, but a previous one did). > > Which is why Shim allows you to disable validation if you prove physical > > user presence. > And that's a giant hack. The actual feature should be that a user > proves physical presence and thus disables lockdown *without* > disabling verification. That's a completely reasonable feature request. -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html