From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755823AbdEYGxa (ORCPT ); Thu, 25 May 2017 02:53:30 -0400 Received: from mx1.redhat.com ([209.132.183.28]:39336 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755796AbdEYGxY (ORCPT ); Thu, 25 May 2017 02:53:24 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 4391080C08 Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=dhowells@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 4391080C08 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <80bdc6c9-004b-800f-ffd0-4b5ebf8cdeba@schaufler-ca.com> References: <80bdc6c9-004b-800f-ffd0-4b5ebf8cdeba@schaufler-ca.com> <149563711758.9419.11406612723056598045.stgit@warthog.procyon.org.uk> <149563714531.9419.16811189348445249219.stgit@warthog.procyon.org.uk> To: Casey Schaufler Cc: dhowells@redhat.com, ard.biesheuvel@linaro.org, matthew.garrett@nebula.com, linux-security-module@vger.kernel.org, linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 3/5] Add the ability to lock down access to the running kernel image MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <19782.1495695202.1@warthog.procyon.org.uk> Date: Thu, 25 May 2017 07:53:22 +0100 Message-ID: <19783.1495695202@warthog.procyon.org.uk> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Thu, 25 May 2017 06:53:24 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Casey Schaufler wrote: > > +#ifdef CONFIG_LOCK_DOWN_KERNEL > > +extern bool kernel_is_locked_down(void); > > +#else > > +static inline bool kernel_is_locked_down(void) > > Should this be a bool or an int? I can imagine that someone is going to want > various different degrees of lock down for kernels. As an int you could > return a bitmap indicating which features were locked. This would allow > additional things to be locked down without changing the interface. At the moment it makes no difference, since the return value is only ever passed directly to an if-statement. Also, do you have an idea as to how is should be divided up? There aren't so many cases, at least not yet, that they can't be fixed up, perhaps with a coccinelle script. David