Hi David, On Wed, Apr 04, 2018 at 05:17:24PM +0100, David Howells wrote: > Andy Lutomirski <luto@xxxxxxxxxx> wrote: > > > Since this thread has devolved horribly, I'm going to propose a solution. > > > > 1. Split the "lockdown" state into three levels: (please don't > > bikeshed about the names right now.) > > > > LOCKDOWN_NONE: normal behavior > > > > LOCKDOWN_PROTECT_INTEGREITY: kernel tries to keep root from writing to > > kernel memory > > > > LOCKDOWN_PROTECT_INTEGRITY_AND_SECRECY: kernel tries to keep root from > > reading or writing kernel memory. > > In theory, it's good idea, but in practice it's not as easy to implement as I > think you think. > > Let me list here the things that currently get restricted by lockdown: > [...snip] > (5) Kexec. > About IMA with kernel module signing and kexec(not on x86_64 yet)... Because IMA can be used to verify the integrity of kernel module or even the image for kexec. I think that the IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY must be enabled at runtime when kernel is locked-down. Because the root can enroll master key to keyring then IMA trusts the ima key derived from master key. It causes that the arbitrary signed module can be loaded when the root compromised. Thanks Joey Lee -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
