Re: [GIT PULL] Kernel lockdown for secure boot

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Theodore Y. Ts'o <tytso@xxxxxxx> wrote:

> > Lockdown mode restricts kexec to booting an authorised image (where the
> > authorisation may be by signature or by IMA).
> 
> If that's true, then Matthew's assertion that lockdown w/o secure boot
> is insecure goes away, no?

No.

Lockdown prevents the running kernel from being modified (or, at least, that's
the hope).

But it doesn't do anything to prevent the kernel being modified before
lockdown is engaged.

We are trying to use secureboot to protect the system to the point that
lockdown can take over.

David

--
To unsubscribe from this list: send the line "unsubscribe linux-efi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux