Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Wed, 8 Nov 2017 22:01:48 +0530
From:   Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>
To:     David Howells <dhowells@redhat.com>
Cc:     Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>,
        "David S. Miller" <davem@davemloft.net>,
        Masami Hiramatsu <mhiramat@kernel.org>,
        linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [RFC][PATCH] Lock down kprobes
Reply-To: ananth@linux.vnet.ibm.com
References: <14323.1510158093@warthog.procyon.org.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <14323.1510158093@warthog.procyon.org.uk>
User-Agent: Mutt/1.9.1 (2017-09-22)
Message-Id: <20171108163148.GA8882@in.ibm.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Wed, Nov 08, 2017 at 04:21:33PM +0000, David Howells wrote:
> Hi,
> 
> I need to lock down kprobes under secure boot conditions as part of the patch
> series that can be found here:
> 
> 	https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/log/?h=efi-lock-down
> 
> Can you tell me that if the attached patch is sufficient to the cause?

This will not prevent the raw kprobe events from working. If your
intention is to prevent *any* kprobe registration, the best place to do
that is in register_kprobe() in kernel/probes.c

Ananth


From 1583515606617523183@xxx Wed Nov 08 16:22:43 +0000 2017
X-GM-THRID: 1583515606617523183
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread