linux-kernel - Re: [PATCH] kexec: add sysctl to disable kexec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 9 Dec 2013 16:15:24 -0800
From:	Kees Cook <keescook@...omium.org>
To:	Rik van Riel <riel@...hat.com>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	Matthew Garrett <matthew.garrett@...ula.com>,
	Vivek Goyal <vgoyal@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Eric Biederman <ebiederm@...ssion.com>,
	Ingo Molnar <mingo@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Mel Gorman <mgorman@...e.de>, kexec@...ts.infradead.org
Subject: Re: [PATCH] kexec: add sysctl to disable kexec

On Mon, Dec 9, 2013 at 3:53 PM, Rik van Riel <riel@...hat.com> wrote:
> On 12/09/2013 06:38 PM, Kees Cook wrote:
>> For general-purpose (i.e. distro) kernel builds it makes sense to build with
>> CONFIG_KEXEC to allow end users to choose what kind of things they want to do
>> with kexec. However, in the face of trying to lock down a system with such
>> a kernel, there needs to be a way to disable kexec (much like module loading
>> can be disabled). Without this, it is too easy for the root user to modify
>> kernel memory even when CONFIG_STRICT_DEVMEM and modules_disabled are set.
>
> Not everybody will be running with selinux, or another LSM security
> policy, so having this simple knob probably makes sense.
>
> OTOH, are the people who run without a fancy security people the
> same people who are interested in locking down the system?
>
> I guess I'll ack the patch, since I see no real downside to having
> the knob...

Thanks! Yeah, there are cases of machines that are trying to be as
locked down as possible while still not having secure boot, etc. This
helps raise the bar for them.

>
>> Signed-off-by: Kees Cook <keescook@...omium.org>
>
> Acked-by: Rik van Riel <riel@...hat.com>

Thanks! I'm sending a v2 since I spaced out on updating the sysctl docs.

-Kees

-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/