linux-kernel - Re: [GIT PULL] Kernel lockdown for secure boot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 26 Oct 2017 14:22:22 -0400
From:   Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:     David Howells <dhowells@...hat.com>, jmorris@...ei.org
Cc:     gnomes@...rguk.ukuu.org.uk, linux-efi@...r.kernel.org,
        mjg59@...gle.com, gregkh@...uxfoundation.org,
        linux-kernel@...r.kernel.org, jforbes@...hat.com,
        linux-man@...r.kernel.org, jlee@...e.com,
        linux-security-module@...r.kernel.org
Subject: Re: [GIT PULL] Kernel lockdown for secure boot

On Thu, 2017-10-26 at 17:37 +0100, David Howells wrote:
> Hi James,
> 
> Can you pull this patchset into security/next please?
> 
> It adds kernel lockdown support for EFI secure boot.  Note that it doesn't yet
> cover:
> 
> 	bpf	- No agreement as to how
> 	ftrace	- Recently suggested, query sent to maintainer
> 	perf	- Not looked at yet.
> 
> and there are some changes recently proposed that make it work with IMA that
> I'll pass on as a follow up when we've fully worked them out.

There's a major difference between leaving out support and preventing
properly signed code from working properly.  We're already at -rc6.
I'm just not sure how there will be time to include the patches, test,
and send James a subsequent pull request before the next open window?

Mimi