From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754521AbaCMV23 (ORCPT ); Thu, 13 Mar 2014 17:28:29 -0400 Received: from terminus.zytor.com ([198.137.202.10]:44320 "EHLO mail.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754335AbaCMV21 (ORCPT ); Thu, 13 Mar 2014 17:28:27 -0400 Message-ID: <532222E1.2020405@zytor.com> Date: Thu, 13 Mar 2014 14:28:01 -0700 From: "H. Peter Anvin" User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: One Thousand Gnomes , Matthew Garrett CC: "jmorris@namei.org" , "linux-kernel@vger.kernel.org" , "keescook@chromium.org" , "linux-security-module@vger.kernel.org" , "akpm@linux-foundation.org" , "jwboyer@fedoraproject.org" , "linux-efi@vger.kernel.org" , "gregkh@linuxfoundation.org" Subject: Re: Trusted kernel patchset for Secure Boot lockdown References: <1393445473-15068-1-git-send-email-matthew.garrett@nebula.com> <1394686919.25122.2.camel@x230> <1394726363.25122.16.camel@x230> <20140313212450.67f1de8e@alan.etchedpixels.co.uk> In-Reply-To: <20140313212450.67f1de8e@alan.etchedpixels.co.uk> X-Enigmail-Version: 1.6 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/13/2014 02:24 PM, One Thousand Gnomes wrote: > > If I have CAP_SYS_RAWIO I can make arbitary ring 0 calls from userspace, > trivially and in a fashion well known and documented. > ... and once we eliminate CAP_SYS_RAWIO a bunch of the patches become redundant. -hpa