On Tue, Apr 3, 2018 at 3:53 PM Andy Lutomirski <luto@xxxxxxxxxx> wrote: > On Tue, Apr 3, 2018 at 3:51 PM, Matthew Garrett <mjg59@xxxxxxxxxx> wrote: > > Lockdown is clearly useful without Secure Boot (and I intend to deploy it > > that way for various things), but I still don't understand why you feel > > that the common case of booting a kernel from a boot chain that's widely > > trusted derives no benefit from it being harder to subvert that kernel into > > subverting that boot chain. For cases where you're self-signing and feel > > happy about that, you just set CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT to n and > > everyone's happy? > I would like to see distros that want Secure Boot to annoy users by > enabling Lockdown be honest about the fact that it's an annoyance and > adds very little value by having to carry a patch that was rejected by > the upstream kernel. I disagree with the assertion that it adds very little value, but if you want to reject a technically useful patch for political reasons then I'm well beyond the point of caring. -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
