Alexei Starovoitov <alexei.starovoitov@xxxxxxxxx> wrote: > this will obviously break the program. Yeah. But if it allows one to twiddle the kernel image or gain access to crypto material... > How about disabling loading tracing programs during the lockdown completely? Interesting thought. I'm not sure how much would actually need locking down here. Turning on tracepoints in the kernel and reading out of the trace buffer, for example, ought to be okay, though if there are any tracepoints that leak crypto information, they may need locking down also. Basically, I think it boils down to: if it can be used to modify the kernel image or read arbitrary data from the kernel image then should probably be forbidden. There have to be exceptions, though, such as loading authenticated kernel modules. David -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
