linux-kernel - Re: [PATCH v5 00/21] EVM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1306433514.24986.26.camel@localhost.localdomain>
Date:	Thu, 26 May 2011 14:11:54 -0400
From:	David Safford <safford@...son.ibm.com>
To:	Casey Schaufler <casey@...aufler-ca.com>
Cc:	Pavel Machek <pavel@....cz>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Mimi Zohar <zohar@...ux.vnet.ibm.com>,
	linux-security-module@...r.kernel.org,
	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
	James Morris <jmorris@...ei.org>, Greg KH <greg@...ah.com>,
	Dmitry Kasatkin <dmitry.kasatkin@...ia.com>
Subject: Re: [PATCH v5 00/21] EVM

On Thu, 2011-05-26 at 09:34 -0700, Casey Schaufler wrote:
> On 5/25/2011 11:08 PM, Pavel Machek wrote:
> > ...
> > Fourthly, is it likely to find its way to the next cellphone I buy,
> > and will it prevent me from rooting it?
> > 								Pavel
> 
> That will of course depend on the phone vendor. You are certainly
> going to be able to vote with your checkbook (digital wallet?) but
> odds are pretty good that should EVM prove effective it will be
> ubiquitous within the next five years on embedded devices.

um, not quite the right threat model...

Rooting is normally done through an exploit of the loader
or the kernel, neither of which EVM can prevent. The phones
which have blocked rooting in hardware have done so by adding
and enforcing digital signatures on the boot images, which is
entirely orthogonal to EVM.

Whether or not the phone is rooted, IMA-Appraisal, EVM, and 
the Digital Signature Extensions help protect against remote
software attacks, and offline hardware attacks on individual
files, but not against rooting itself.

dave
(happy owner of a rooted Droid)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/