Re: [PATCH 00/12] One more attempt at useful kernel lockdown

Valdis.Kletnieks
2013-09-09T19:01:49Z

[-- Attachment #1: Type: text/plain, Size: 517 bytes --]

On Mon, 09 Sep 2013 11:25:38 -0700, David Lang said:

> Given that we know that people want signed binaries without blocking kexec, you
> should have '1' just enforce module signing and '2' (or higher) implement a full
> lockdown including kexec.

> Or, eliminate the -1 permanently insecure option and make this a bitmask, if
> someone wants to enable every possible lockdown, have them set it to "all 1's",
> define the bits only as you need them.

This strikes me as much more workable than one big sledgehammer.

[-- Attachment #2: Type: application/pgp-signature, Size: 865 bytes --]