On Tue, Apr 3, 2018 at 5:04 PM, Matthew Garrett <mj...@google.com> wrote: > > How? When there are random DMA-capable PCI devices that are driven by > userland tools that are mmap()ing the BARs out of sysfs, how do we > simultaneously avoid breaking those devices while also preventing the > majority of users from being vulnerable to an attacker just DMAing over the > kernel?
.. if that ends up being a real problem, then you print a warning and tell people to use the kernel command line to disable things. And if it's a big and common problem, then the answer may be that lockdown has to be entirely OFF by default, and you instead just tell people to enable it manually with a kernel command line option. Still better than telling them to disable/enable secure boot, which they may or may not even be able to to. Linus