On lun., 2013-01-28 at 11:42 -0500, Matthew Garrett wrote:
> Secure boot makes it possible to ensure that the on-disk representation of
> the kernel hasn't been modified. This can be sidestepped if the in-memory
> representation can be trivially altered. We currently have a large number
> of interfaces that permit root to perform effectively arbitrary
> modifications to the kernel, so this patchset introduces a new capability
> ("CAP_COMPROMISE_KERNEL") that controls whether or not these features are
> available. The aim is for this to be useful in any other situations where
> kernel integrity can be assured by some other mechanism rather than special
> casing UEFI.
>
Wouldn't it make sense to prevent writing to MSRs too? Something like
c903f0456bc69176912dee6dd25c6a66ee1aed00 with CAP_COMPROMISE_KERNEL?
Regards,
--
Yves-Alexis
Attachment:
signature.asc
Description: This is a digitally signed message part
