Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1761864Ab2KAPCG (ORCPT ); Thu, 1 Nov 2012 11:02:06 -0400 Received: from lxorguk.ukuu.org.uk ([81.2.110.251]:34771 "EHLO lxorguk.ukuu.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1761655Ab2KAPCC (ORCPT ); Thu, 1 Nov 2012 11:02:02 -0400 Date: Thu, 1 Nov 2012 15:06:54 +0000 From: Alan Cox To: Matthew Garrett Cc: James Bottomley , Eric Paris , Jiri Kosina , Oliver Neukum , Chris Friesen , Josh Boyer , linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-efi@vger.kernel.org Subject: Re: [RFC] Second attempt at kernel secure boot support Message-ID: <20121101150654.19efe0b5@pyramind.ukuu.org.uk> In-Reply-To: <20121101144912.GA10269@srcf.ucam.org> References: <2548314.3caaFsMVg6@linux-lqwf.site> <50919EED.3020601@genband.com> <36538307.gzWq1oO7Kg@linux-lqwf.site> <1351760905.2391.19.camel@dabdike.int.hansenpartnership.com> <1351762703.2391.31.camel@dabdike.int.hansenpartnership.com> <1351763954.2391.37.camel@dabdike.int.hansenpartnership.com> <1351780935.2391.58.camel@dabdike.int.hansenpartnership.com> <20121101144912.GA10269@srcf.ucam.org> X-Mailer: Claws Mail 3.8.1 (GTK+ 2.24.8; x86_64-redhat-linux-gnu) Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAFVBMVEWysKsSBQMIAwIZCwj///8wIhxoRDXH9QHCAAABeUlEQVQ4jaXTvW7DIBAAYCQTzz2hdq+rdg494ZmBeE5KYHZjm/d/hJ6NfzBJpp5kRb5PHJwvMPMk2L9As5Y9AmYRBL+HAyJKeOU5aHRhsAAvORQ+UEgAvgddj/lwAXndw2laEDqA4x6KEBhjYRCg9tBFCOuJFxg2OKegbWjbsRTk8PPhKPD7HcRxB7cqhgBRp9Dcqs+B8v4CQvFdqeot3Kov6hBUn0AJitrzY+sgUuiA8i0r7+B3AfqKcN6t8M6HtqQ+AOoELCikgQSbgabKaJW3kn5lBs47JSGDhhLKDUh1UMipwwinMYPTBuIBjEclSaGZUk9hDlTb5sUTYN2SFFQuPe4Gox1X0FZOufjgBiV1Vls7b+GvK3SU4wfmcGo9rPPQzgIabfj4TYQo15k3bTHX9RIw/kniir5YbtJF4jkFG+dsDK1IgE413zAthU/vR2HVMmFUPIHTvF6jWCpFaGw/A3qWgnbxpSm9MSmY5b3pM1gvNc/gQfwBsGwF0VCtxZgAAAAASUVORK5CYII= Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1059 Lines: 23 > The entire point of this feature is that it's no longer possible to turn > a privileged user exploit into a full system exploit. Gaining admin > access on Windows 8 doesn't permit you to install a persistent backdoor, Really, that would be a first. Do you have a detailed knowledge of windows 8 actual security ? > unless there's some way to circumvent that. Which there is, if you can > drop a small Linux distribution onto the ESP and use a signed, trusted > bootloader to boot a signed, trusted kernel that then resumes from an > unsigned, untrusted hibernate image. So we have to ensure that that's > impossible. Well if you want to make Linux entirely robust Red Hat could start helping with some of the 6000 odd coverity matches some of which will most certainly turn out to be real flaws. Alan -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/