News for hackers. Stuff that matters.

A comment on Linux Kernel Lockdown and UEFI Secure Boot. Parent comment

Re:Linux Kernel Lockdown and UEFI Secure Boot by tjoff on Thursday April 05, 2018 @11:22AM (#16765707)
Supposedly yes, but shoudln't it vastly reduce the attack surface by not having to worry (compared to now) about all device drivers that use DMA (which otherwise is just impossible to keep track of).

In my opinion reducing that attack surface alone on b) has a much higher impact than a) could ever achieve.

[ Parent | on HN ]
Re:Linux Kernel Lockdown and UEFI Secure Boot by mjg59 on Thursday April 05, 2018 @12:43PM (#16766503)
The stuff lockdown impacts is stuff that only root can do right now, so in theory it's only handling channels that are irrelevant to b). Users should already be prevented from triggering arbitrary DMA, for instance.
[ Parent | on HN ]
Re:Linux Kernel Lockdown and UEFI Secure Boot by tjoff on Thursday April 05, 2018 @07:33PM (#16769732)
Well, should, again, device drivers are notoriously bad and some protection against that is extremely valuable.
[ Parent | on HN ]
Re:Linux Kernel Lockdown and UEFI Secure Boot by Jasper_ on Thursday April 05, 2018 @11:57AM (#16766074)
a) prevents a temporary breach of b) from turning into a persistent attack. b) is still very important, so important that when b) breaks it is considered a CVE!
[ Parent | on HN ]