Re:Linux Kernel Lockdown and UEFI Secure Boot
by mjg59 on Thursday April 05, 2018 @04:25AM
(#16762938)
There's a kernel-imposed boundary between being a user and being root. Right now there's also a partial barrier between being root and being the kernel that's fairly easily circumvented. Now that we can protect the on-disk copy of the kernel from root, there's also interest in protecting the in-memory copy of the kernel from root.
[ Parent
| on HN ]
Re:Linux Kernel Lockdown and UEFI Secure Boot
by tjoff on Thursday April 05, 2018 @10:30AM
(#16765200)
Yes. And lockdown helps with (right?):
a) locking root out of kernel
b) locking users from becoming root
I interpret the reasoning as: if we can't do a AND b we won't bother with b. Which is confusing because b is many orders of magnitudes more important than a.
Re:Linux Kernel Lockdown and UEFI Secure Boot
by mjg59 on Thursday April 05, 2018 @11:10AM
(#16765598)
b) is a barrier that's already supposed to exist, so these patches don't have an impact on it.
Re:Linux Kernel Lockdown and UEFI Secure Boot
by tjoff on Thursday April 05, 2018 @11:22AM
(#16765707)
Supposedly yes, but shoudln't it vastly reduce the attack surface by not having to worry (compared to now) about all device drivers that use DMA (which otherwise is just impossible to keep track of).
In my opinion reducing that attack surface alone on b) has a much higher impact than a) could ever achieve.
Re:Linux Kernel Lockdown and UEFI Secure Boot
by mjg59 on Thursday April 05, 2018 @12:43PM
(#16766503)
The stuff lockdown impacts is stuff that only root can do right now, so in theory it's only handling channels that are irrelevant to b). Users should already be prevented from triggering arbitrary DMA, for instance.