linux-kernel - Re: [PATCH 00/12] One more attempt at useful kernel lockdown

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.02.1309091119330.2479@nftneq.ynat.uz>
Date:	Mon, 9 Sep 2013 11:25:38 -0700 (PDT)
From:	David Lang <david@...g.hm>
To:	Valdis.Kletnieks@...edu
cc:	Matthew Garrett <matthew.garrett@...ula.com>,
	linux-kernel@...r.kernel.org, keescook@...omium.org,
	gregkh@...uxfoundation.org, hpa@...or.com,
	linux-efi@...r.kernel.org, jmorris@...ei.org,
	linux-security-module@...r.kernel.org
Subject: Re: [PATCH 00/12] One more attempt at useful kernel lockdown

On Mon, 9 Sep 2013, Valdis.Kletnieks@...edu wrote:

> On Mon, 09 Sep 2013 11:49:34 -0400, Matthew Garrett said:
>
>> So, this is my final attempt at providing the functionality I'm interested
>> in without inherently tying it to Secure Boot. There's strong parallels
>> between the functionality that I'm interested in and the BSD securelevel
>> interface, so here's a trivial implementation.
>
> Although all the individual patches look like sane and reasonable things
> to do, I'm not at all convinced that sticking them all under control of one
> flag is really the right way to do it.  In particular, there probably needs
> to be some re-thinking of the kexec, signed-module, and secure-boot stuff,
> as it's still a moving target.

Given that we know that people want signed binaries without blocking kexec, you 
should have '1' just enforce module signing and '2' (or higher) implement a full 
lockdown including kexec.

Or, eliminate the -1  permanently insecure option and make this a bitmask, if 
someone wants to enable every possible lockdown, have them set it to "all 1's", 
define the bits only as you need them.

right now
1 lock down modules
2 lock down kexec

etc

you may also want to have a 'disable module loading after this point' in the 
future.

David Lang
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/