On Wed, Aug 04, 2021 at 01:09:07PM -0700, Kuppuswamy, Sathyanarayanan wrote: > > > On 8/4/21 12:50 PM, Andi Kleen wrote: > > > > > And what's wrong with the current method of removing drivers from > > > devices that you do not want them to be bound to? We offer that support > > > for all busses now that want to do it, what driver types are you needing > > > to "control" here that does not take advantage of the existing > > > infrastructure that we currently have for this type of thing? > > > > I'm not sure what mechanism you're referring to here, but in general > > don't want the drivers to initialize at all because they might get > > exploited in any code that they execute.The intention is to disable all > > drivers except for a small allow list, because it's not practical to > > harden all 25M lines of Linux code. > > Yes, we are not trying to remove the drivers via sysfs. If driver > filter is enabled, "allowed" sysfs file is used to view the driver > filter status (allowed/denied). And a write to that file changes > the allowed/denied status of the driver. It has nothing to do > with bind/unbind operations. Again, we have this already today, with full sysfs control in userspace. Why add yet-another-way to do this? What is lacking in the existing functionality that needs to be expanded on? greg k-h
