From: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
To: Matthew Garrett <mjg59@srcf.ucam.org>
Cc: Greg KH <gregkh@linuxfoundation.org>,
David Howells <dhowells@redhat.com>,
linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org, keyrings@vger.kernel.org,
minyard@acm.org
Subject: Re: [PATCH 01/39] Annotate module params that specify hardware parameters (eg. ioport)
Date: Mon, 5 Dec 2016 21:26:41 +0000 [thread overview]
Message-ID: <20161205212641.615f2610@lxorguk.ukuu.org.uk> (raw)
In-Reply-To: <20161202071246.GA27889@srcf.ucam.org>
> If the parameters plausibly make it possible for root to modify the
> kernel in interesting ways, then restricting them makes sense. My gut
> sense is that parameters that allow the alteration of the base address
> of memory mapped devices are clearly a problem in this respect, but port
> io and IRQs *probably* aren't. On the other hand, blocking mmio base
> addresses and not blocking the others is kind of inconsistent.
It is actually useful even without secure boot because right now
DAC capability bypass is easier to get and gives you CAP_SYS_RAWIO if
you've mastered your first class in being an 3733t h4x0r. (because you can
modify /etc/moprobe.d/* and even with signed modules that's not
protected).
It's also the case if you go through those drivers that pretty much none
of them are found on a modern EFI and secure boot enabled system and
those that are will be using ACPI, PCI, devicetree or other reliablish
bus enumerations instead. The cross section of people needing io=foo, and
having secure boot is close to nil.
> This is a logical extension to the base patchset, and one maintainer has
> NAKed the base patchset due to it lacking this feature. If you don't
> care about this then just tell Alan that you want the base patchset
> merged anyway and we'll go from there. Let's not get into a situation
> where people are being given incompatible requirements before
> something's merged.
The base patchset actually doesn't do anything without it. I'd hope the
vendors adopt it anyway if they are serious about secure boot (or
security in general) given it's really valuable even without the secure
boot firmware nonsense to be able to boot a machine and then lock down
raw I/O access.
Alan
next prev parent reply other threads:[~2016-12-05 21:27 UTC|newest]
Thread overview: 78+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-01 12:29 [PATCH 00/39] Annotate hw config module params for future lockdown David Howells
2016-12-01 12:29 ` [PATCH 01/39] Annotate module params that specify hardware parameters (eg. ioport) David Howells
2016-12-01 15:01 ` Greg KH
2016-12-02 3:07 ` Matthew Garrett
2016-12-02 6:55 ` Greg KH
2016-12-02 7:12 ` Matthew Garrett
2016-12-05 21:26 ` One Thousand Gnomes [this message]
2016-12-02 14:59 ` David Howells
2016-12-05 15:47 ` Greg KH
2016-12-06 10:54 ` David Howells
2016-12-01 16:02 ` David Howells
2016-12-05 21:12 ` One Thousand Gnomes
2016-12-06 7:11 ` Greg KH
2016-12-06 10:42 ` David Howells
2016-12-06 10:50 ` Greg KH
2016-12-01 12:29 ` [PATCH 02/39] Annotate hardware config module parameters in arch/x86/mm/ David Howells
2016-12-01 12:30 ` [PATCH 03/39] Annotate hardware config module parameters in drivers/char/ipmi/ David Howells
2016-12-01 13:14 ` Corey Minyard
2016-12-01 12:30 ` [PATCH 04/39] Annotate hardware config module parameters in drivers/char/mwave/ David Howells
2016-12-01 12:30 ` [PATCH 05/39] Annotate hardware config module parameters in drivers/char/ David Howells
2016-12-01 12:30 ` [PATCH 06/39] Annotate hardware config module parameters in drivers/clocksource/ David Howells
2016-12-01 12:30 ` [PATCH 07/39] Annotate hardware config module parameters in drivers/cpufreq/ David Howells
2016-12-01 14:02 ` Rafael J. Wysocki
2016-12-01 14:19 ` David Howells
2016-12-01 14:21 ` Rafael J. Wysocki
2016-12-01 12:30 ` [PATCH 08/39] Annotate hardware config module parameters in drivers/gpio/ David Howells
2016-12-01 13:49 ` William Breathitt Gray
2016-12-02 12:55 ` Linus Walleij
2016-12-01 12:30 ` [PATCH 09/39] Annotate hardware config module parameters in drivers/i2c/ David Howells
2016-12-01 13:47 ` Jean Delvare
2016-12-01 14:12 ` David Howells
2016-12-01 16:06 ` Jean Delvare
2016-12-05 21:09 ` One Thousand Gnomes
2016-12-01 12:30 ` [PATCH 10/39] Annotate hardware config module parameters in drivers/iio/ David Howells
2016-12-01 13:50 ` William Breathitt Gray
2016-12-03 9:05 ` Jonathan Cameron
2016-12-07 13:43 ` David Howells
2016-12-01 12:31 ` [PATCH 11/39] Annotate hardware config module parameters in drivers/input/ David Howells
2016-12-03 18:51 ` Dmitry Torokhov
2016-12-01 12:31 ` [PATCH 12/39] Annotate hardware config module parameters in drivers/isdn/ David Howells
2016-12-01 12:31 ` [PATCH 13/39] Annotate hardware config module parameters in drivers/media/ David Howells
2016-12-01 12:31 ` [PATCH 14/39] Annotate hardware config module parameters in drivers/misc/ David Howells
2016-12-01 12:31 ` [PATCH 15/39] Annotate hardware config module parameters in drivers/mmc/host/ David Howells
2016-12-01 12:31 ` [PATCH 16/39] Annotate hardware config module parameters in drivers/net/appletalk/ David Howells
2016-12-01 12:31 ` [PATCH 17/39] Annotate hardware config module parameters in drivers/net/arcnet/ David Howells
2016-12-01 12:32 ` [PATCH 18/39] Annotate hardware config module parameters in drivers/net/can/ David Howells
2016-12-01 13:05 ` Marc Kleine-Budde
2016-12-01 12:32 ` [PATCH 19/39] Annotate hardware config module parameters in drivers/net/ethernet/ David Howells
2016-12-01 12:32 ` [PATCH 20/39] Annotate hardware config module parameters in drivers/net/hamradio/ David Howells
2016-12-01 12:32 ` [PATCH 21/39] Annotate hardware config module parameters in drivers/net/irda/ David Howells
2016-12-01 12:32 ` [PATCH 22/39] Annotate hardware config module parameters in drivers/net/wan/ David Howells
2016-12-01 12:32 ` [PATCH 23/39] Annotate hardware config module parameters in drivers/net/wireless/ David Howells
2016-12-02 5:04 ` Kalle Valo
2016-12-07 13:45 ` David Howells
2016-12-01 12:32 ` [PATCH 24/39] Annotate hardware config module parameters in drivers/parport/ David Howells
2016-12-01 12:32 ` [PATCH 25/39] Annotate hardware config module parameters in drivers/pci/hotplug/ David Howells
2016-12-07 18:34 ` Bjorn Helgaas
2016-12-01 12:33 ` [PATCH 26/39] Annotate hardware config module parameters in drivers/pcmcia/ David Howells
2016-12-01 12:33 ` [PATCH 27/39] Annotate hardware config module parameters in drivers/scsi/ David Howells
2016-12-01 22:05 ` Finn Thain
2017-04-05 14:33 ` David Howells
2016-12-01 12:33 ` [PATCH 28/39] Annotate hardware config module parameters in drivers/staging/i4l/ David Howells
2016-12-01 12:33 ` [PATCH 29/39] Annotate hardware config module parameters in drivers/staging/media/ David Howells
2016-12-01 14:54 ` Mauro Carvalho Chehab
2016-12-01 14:59 ` David Howells
2016-12-01 15:17 ` Mauro Carvalho Chehab
2016-12-01 12:33 ` [PATCH 30/39] Annotate hardware config module parameters in drivers/staging/speakup/ David Howells
2016-12-01 12:33 ` [PATCH 31/39] Annotate hardware config module parameters in drivers/staging/vme/ David Howells
2016-12-01 12:33 ` [PATCH 32/39] Annotate hardware config module parameters in drivers/tty/ David Howells
2016-12-01 15:02 ` Greg Kroah-Hartman
2016-12-01 12:34 ` [PATCH 33/39] Annotate hardware config module parameters in drivers/video/ David Howells
2016-12-01 12:34 ` [PATCH 34/39] Annotate hardware config module parameters in drivers/watchdog/ David Howells
2016-12-01 12:58 ` Guenter Roeck
2016-12-01 12:34 ` [PATCH 35/39] Annotate hardware config module parameters in fs/pstore/ David Howells
2016-12-01 12:34 ` [PATCH 36/39] Annotate hardware config module parameters in sound/drivers/ David Howells
2016-12-01 12:34 ` [PATCH 37/39] Annotate hardware config module parameters in sound/isa/ David Howells
2016-12-01 12:34 ` [PATCH 38/39] Annotate hardware config module parameters in sound/oss/ David Howells
2016-12-01 12:34 ` [PATCH 39/39] Annotate hardware config module parameters in sound/pci/ David Howells
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161205212641.615f2610@lxorguk.ukuu.org.uk \
--to=gnomes@lxorguk.ukuu.org.uk \
--cc=dhowells@redhat.com \
--cc=gregkh@linuxfoundation.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=minyard@acm.org \
--cc=mjg59@srcf.ucam.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®