linux-kernel - Re: [PATCH v2] x86/ima: require signed kernel modules

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CACdnJutjkkk0M7r-2Cm1oBGxRS7CjZXmjn7CYQ+E-cg4HPkzQA@mail.gmail.com>
Date:   Thu, 7 Mar 2019 14:45:49 -0800
From:   Matthew Garrett <mjg59@...gle.com>
To:     Mimi Zohar <zohar@...ux.ibm.com>
Cc:     linux-integrity <linux-integrity@...r.kernel.org>,
        LSM List <linux-security-module@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Jessica Yu <jeyu@...nel.org>,
        Luis Chamberlain <mcgrof@...nel.org>,
        David Howells <dhowells@...hat.com>,
        Seth Forshee <seth.forshee@...onical.com>,
        "Bruno E . O . Meneguele" <bmeneg@...hat.com>
Subject: Re: [PATCH v2] x86/ima: require signed kernel modules

On Thu, Mar 7, 2019 at 2:41 PM Mimi Zohar <zohar@...ux.ibm.com> wrote:
> On Thu, 2019-03-07 at 14:36 -0800, Matthew Garrett wrote:
> > Right, but how is this different to what Linus was objecting to?
>
> Both Andy Lutomirski and Linus objected to limiting the "lockdown"
> patch set to secure boot enabled systems.

No, Linus objected to it being automatically enabled when secure boot
was enabled. It was always possible to enable it at boot on any
platform.