From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752872AbdJUCLx (ORCPT ); Fri, 20 Oct 2017 22:11:53 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:23030 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752664AbdJUCLw (ORCPT ); Fri, 20 Oct 2017 22:11:52 -0400 Date: Sat, 21 Oct 2017 06:11:34 +0400 (+04) From: James Morris X-X-Sender: james.l.morris@t440 To: David Howells cc: linux-security-module@vger.kernel.org, gnomes@lxorguk.ukuu.org.uk, linux-efi@vger.kernel.org, matthew.garrett@nebula.com, gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, jforbes@redhat.com Subject: Re: [PATCH 25/27] Lock down /proc/kcore In-Reply-To: <150842482228.7923.9630520914833154257.stgit@warthog.procyon.org.uk> Message-ID: References: <150842463163.7923.11081723749106843698.stgit@warthog.procyon.org.uk> <150842482228.7923.9630520914833154257.stgit@warthog.procyon.org.uk> User-Agent: Alpine 2.20 (LFD 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-Source-IP: userv0021.oracle.com [156.151.31.71] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 19 Oct 2017, David Howells wrote: > Disallow access to /proc/kcore when the kernel is locked down to prevent > access to cryptographic data. > > Signed-off-by: David Howells Reviewed-by: James Morris I have to wonder, though, after everything is locked down, how easy will it be for new things to slip in which need to be included in the lockdown, but are not. -- James Morris