Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753406Ab2KBTSN (ORCPT ); Fri, 2 Nov 2012 15:18:13 -0400 Received: from mail-lb0-f174.google.com ([209.85.217.174]:62565 "EHLO mail-lb0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750813Ab2KBTSI (ORCPT ); Fri, 2 Nov 2012 15:18:08 -0400 MIME-Version: 1.0 In-Reply-To: <20121102180458.GA12052@srcf.ucam.org> References: <1351763954.2391.37.camel@dabdike.int.hansenpartnership.com> <20121101202701.GB20817@xo-6d-61-c0.localdomain> <5092E361.7080901@genband.com> <20121102163302.GA6080@elf.ucw.cz> <1351875164.2439.42.camel@dabdike.int.hansenpartnership.com> <20121102165456.GB9997@srcf.ucam.org> <1351878511.2439.44.camel@dabdike.int.hansenpartnership.com> <20121102175416.GA11816@srcf.ucam.org> <1351879058.2439.46.camel@dabdike.int.hansenpartnership.com> <20121102180458.GA12052@srcf.ucam.org> Date: Fri, 2 Nov 2012 15:18:06 -0400 Message-ID: Subject: Re: [RFC] Second attempt at kernel secure boot support From: Eric Paris To: Matthew Garrett Cc: James Bottomley , Pavel Machek , Chris Friesen , Jiri Kosina , Oliver Neukum , Alan Cox , Josh Boyer , Linux Kernel Mailing List , LSM List , linux-efi@vger.kernel.org Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 812 Lines: 16 I know I started it, but Windows really isn't necessary to see value, even if it is what pushed the timing. A user installs a package as root. Absent any flaws in the Linux kernel (cough) that should be all it can do in a Secure Boot world. But if you can drop a small trusted Linux system in there and use that to boot a compromised Linux kernel, it can make itself persistent. And like I said, I know there are cloud providers out there who want EXACTLY this type of system. One in which root in the guest is untrusted and they want to keep them out of ring 0. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/