Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755410Ab3CTSHD (ORCPT ); Wed, 20 Mar 2013 14:07:03 -0400 Received: from e8.ny.us.ibm.com ([32.97.182.138]:40032 "EHLO e8.ny.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755567Ab3CTSG7 (ORCPT ); Wed, 20 Mar 2013 14:06:59 -0400 Message-ID: <1363802506.2580.55.camel@falcor1.watson.ibm.com> Subject: Re: [PATCH 01/12] Security: Add CAP_COMPROMISE_KERNEL From: Mimi Zohar To: Matthew Garrett Cc: James Morris , "linux-kernel@vger.kernel.org" , "linux-security-module@vger.kernel.org" , "linux-efi@vger.kernel.org" , "kexec@lists.infradead.org" , "linux-pci@vger.kernel.org" Date: Wed, 20 Mar 2013 14:01:46 -0400 In-Reply-To: <1363798166.2553.29.camel@x230.sbx07502.somerma.wayport.net> References: <1363642353-30749-1-git-send-email-matthew.garrett@nebula.com> <1363797717.2580.10.camel@falcor1.watson.ibm.com> <1363798166.2553.29.camel@x230.sbx07502.somerma.wayport.net> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.2.3 (3.2.3-3.fc16) Content-Transfer-Encoding: 7bit Mime-Version: 1.0 X-TM-AS-MML: No X-Content-Scanned: Fidelis XPS MAILER x-cbid: 13032018-9360-0000-0000-000011687C21 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1009 Lines: 25 On Wed, 2013-03-20 at 16:49 +0000, Matthew Garrett wrote: > On Wed, 2013-03-20 at 12:41 -0400, Mimi Zohar wrote: > > > Matthrew, perhaps you could clarify whether this will be tied to MAC > > security. Based on the kexec thread, I'm under the impression that is > > not the intention, or at least not for kexec. As root isn't trusted, > > neither is the boot command line, nor any policy that is loaded by root, > > including those for MAC. > > The work done on signed initramfs fragments would seem to be the best > option here so far? Sorry, I'm not sure to which work you're referring. If you're referring to Dmitry's "initramfs with digital signature protection" patches, then we're speaking about enforcing integrity, not MAC security. thanks, Mimi -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/