From: Matthew Garrett <matthew.garrett@nebula.com>
To: "H. Peter Anvin" <hpa@zytor.com>
CC: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "keescook@chromium.org" <keescook@chromium.org>,
        "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>,
        "linux-efi@vger.kernel.org" <linux-efi@vger.kernel.org>,
        "jmorris@namei.org" <jmorris@namei.org>,
        "linux-security-module@vger.kernel.org" 
	<linux-security-module@vger.kernel.org>
Subject: Re: [PATCH 01/12] Add BSD-style securelevel support
Thread-Topic: [PATCH 01/12] Add BSD-style securelevel support
Thread-Index: AQHOrXST0kcK6RTzv06SuZIfeWETyJm9l/EAgAAioQA=
Date: Mon, 9 Sep 2013 18:31:05 +0000
Message-ID: <1378751464.17982.13.camel@x230.lan>
References: <1378741786-18430-1-git-send-email-matthew.garrett@nebula.com>
	 <1378741786-18430-2-git-send-email-matthew.garrett@nebula.com>
	 <522DF6DC.1050303@zytor.com>
In-Reply-To: <522DF6DC.1050303@zytor.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="utf-8"
Content-ID: <AAAADC9B8E65414AB9A274967479DDAC@namprd05.prod.outlook.com>
MIME-Version: 1.0
Sender: linux-kernel-owner@vger.kernel.org
Content-Transfer-Encoding: 8bit
Content-Length: 1383
Lines: 26

On Mon, 2013-09-09 at 09:27 -0700, H. Peter Anvin wrote:
> On 09/09/2013 08:49 AM, Matthew Garrett wrote:

> > +1:  Secure mode. If set, userspace will be unable to perform direct access
> > +    to PCI devices, port IO access, access system memory directly via
> > +    /dev/mem and /dev/kmem, perform kexec_load(), use the userspace
> > +    software suspend mechanism, insert new ACPI code at runtime via the
> > +    custom_method interface or modify CPU MSRs (on x86). Certain drivers
> > +    may also limit additional interfaces.
> > +
> 
> This will break or have to be redefined once you have signed kexec.

So, thinking about this, how about defining it as:

1:  Secure mode. If set, userspace will be prevented from performing any
operation that would permit the insertion of untrusted code into the
running kernel. At present this includes direct access to PCI devices,
port IO access,  direct system memory access via /dev/mem and /dev/kmem,
kexec_load(), the userspace software suspend mechanism, insertion of new
ACPI code at runtime via the custom_method interface or modification of
CPU MSRs (on x86). Certain drivers may also limit additional interfaces.

-- 
Matthew Garrett <matthew.garrett@nebula.com>
????{.n?+???????+%?????ݶ??w??{.n?+????{??G?????{ay?ʇڙ?,j??f???h?????????z_??(?階?ݢj"???m??????G????????????&???~???iO???z??v?^?m????????????I?