On Tue, Apr 3, 2018 at 5:04 PM, Matthew Garrett <mjg59@xxxxxxxxxx> wrote:
>
> How? When there are random DMA-capable PCI devices that are driven by
> userland tools that are mmap()ing the BARs out of sysfs, how do we
> simultaneously avoid breaking those devices while also preventing the
> majority of users from being vulnerable to an attacker just DMAing over the
> kernel?
.. if that ends up being a real problem, then you print a warning and
tell people to use the kernel command line to disable things.
And if it's a big and common problem, then the answer may be that
lockdown has to be entirely OFF by default, and you instead just tell
people to enable it manually with a kernel command line option.
Still better than telling them to disable/enable secure boot, which
they may or may not even be able to to.
Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-api" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
