Andy Lutomirski <luto@xxxxxxxxxx> wrote: > >>> A kernel that allows users arbitrary access to ring 0 is just an > >>> overfeatured bootloader. Why would you want secure boot in that case? > >> > >> To get a chain of trust. > > > > You don't have a chain of trust that you can trust in that case. > > > Please elaborate on why I can’t trust it. If the user can arbitrarily modify the running kernel image, you cannot trust anything. You cannot determine the trustworthiness of something because your basis for determining that trust can be compromised. > Please also elaborate on how lockdown helps at all. Stopping the kernel from being arbitrarily modified allows you to preserve your trust. Stopping the kernel from being arbitrarily read stops any encryption keys it may be using from being retrieved. And, if you can't guarantee the trustworthiness of your own image, you can't pass the trust onto the next image that you kexec. Now, I can't guarantee that my patches close every hole, they just close all the holes I know about - including some obscure ones like using DMA-capable ISA devices to hack/access the kernel image. David -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
