Matthew Garrett <mjg@xxxxxxxxxx> writes: > This is pretty much identical to the first patchset, but with the capability > renamed (CAP_COMPROMISE_KERNEL) and the kexec patch dropped. If anyone wants > to deploy these then they should disable kexec until support for signed > kexec payloads has been merged. A couple of thoughts. 1) I don't see anything disabling kdb or kgdb. If ever there was a way to poke into the kernel and change things... 2) You almost certainly want to disable module removal. It is all to easy to have races where that are not properly handled in the module removal path. I know I saw a bundle of those in debugfs the other day. 3) And half seriously you probably want to disable mounting of filesystems. I believe I have heard it said the kernel has not been vetted against a hostile root user mounting deliberately corrupted filesystem images. As it is designed I don't believe your patchset can successfully achieve the goal of keeping a determined root user from injecting code into the kernel without disabling so many kernel features the kernel is uninteresting for most people to run. Eric -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
