linux-kernel - Re: Trusted kernel patchset for Secure Boot lockdown

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87lhw684r8.fsf@mid.deneb.enyo.de>
Date:	Wed, 19 Mar 2014 18:42:03 +0100
From:	Florian Weimer <fw@...eb.enyo.de>
To:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
Cc:	Kees Cook <keescook@...omium.org>,
	Matthew Garrett <matthew.garrett@...ula.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Greg KH <gregkh@...uxfoundation.org>,
	"H. Peter Anvin" <hpa@...or.com>,
	"linux-efi\@vger.kernel.org" <linux-efi@...r.kernel.org>,
	James Morris <jmorris@...ei.org>,
	linux-security-module <linux-security-module@...r.kernel.org>
Subject: Re: Trusted kernel patchset for Secure Boot lockdown

* One Thousand Gnomes:

>> For the Chrome OS use-case, it might be better described as "untrusted
>> userspace", but that seems unfriendly. :) The "trusted kernel" name
>> seems fine to me.
>
> Trusted is rather misleading. It's not trusted, it's *measured*.

I don't think anyone is doing any measurement.  In particular, the
kernel does not know anything about the history of the boot process
and cannot provide any form of attestation.  This is why this feature
is not very useful to end users.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/