Re: [PULL REQUEST] Lock down patches

2019-03-04 Thread Matthew Garrett
Hi James, Based on feedback, I'm going to make a couple of small changes to this patchset and then resend.

Re: [PULL REQUEST] Lock down patches

2019-02-28 Thread Mimi Zohar
On Thu, 2019-02-28 at 19:33 -0800, Matthew Garrett wrote: > On Thu, Feb 28, 2019 at 5:45 PM Mimi Zohar wrote: > > > > On Thu, 2019-02-28 at 17:01 -0800, Matthew Garrett wrote: > > > > > > That's not a valid reason for preventing systems that do use IMA for > > > > verifying the kexec kernel image

Re: [PULL REQUEST] Lock down patches

2019-02-28 Thread Matthew Garrett
On Thu, Feb 28, 2019 at 5:45 PM Mimi Zohar wrote: > > On Thu, 2019-02-28 at 17:01 -0800, Matthew Garrett wrote: > > > > That's not a valid reason for preventing systems that do use IMA for > > > verifying the kexec kernel image signature or kernel module signatures > > > from enabling "lock down".

Re: [PULL REQUEST] Lock down patches

2019-02-28 Thread Mimi Zohar
On Thu, 2019-02-28 at 17:01 -0800, Matthew Garrett wrote: > > That's not a valid reason for preventing systems that do use IMA for > > verifying the kexec kernel image signature or kernel module signatures > > from enabling "lock down". This just means that there needs to be > > some coordination

Re: [PULL REQUEST] Lock down patches

2019-02-28 Thread Matthew Garrett
On Thu, Feb 28, 2019 at 4:05 PM Mimi Zohar wrote: > > On Thu, 2019-02-28 at 15:13 -0800, Matthew Garrett wrote: > > On Thu, Feb 28, 2019 at 2:20 PM Mimi Zohar wrote: > > > Where/when was this latest version of the patches posted? > > > > They should have followed this, but git-send-email choked o

Re: [PULL REQUEST] Lock down patches

2019-02-28 Thread Mimi Zohar
On Thu, 2019-02-28 at 15:13 -0800, Matthew Garrett wrote: > On Thu, Feb 28, 2019 at 2:20 PM Mimi Zohar wrote: > > On Thu, 2019-02-28 at 13:28 -0800, Matthew Garrett wrote: > > > This PR is mostly the same as the previous attempt, but with the > > > following changes: > > > > Where/when was this la

Re: [PULL REQUEST] Lock down patches

2019-02-28 Thread Randy Dunlap
On 2/28/19 1:28 PM, Matthew Garrett wrote: > Hi James, > > David is low on cycles at the moment, so I'm taking over for this time > round. This patchset introduces an optional kernel lockdown feature, > intended to strengthen the boundary between UID 0 and the kernel. When > enabled and active (by

Re: [PULL REQUEST] Lock down patches

2019-02-28 Thread Matthew Garrett
On Thu, Feb 28, 2019 at 2:20 PM Mimi Zohar wrote: > On Thu, 2019-02-28 at 13:28 -0800, Matthew Garrett wrote: > > This PR is mostly the same as the previous attempt, but with the > > following changes: > > Where/when was this latest version of the patches posted? They should have followed this, b

Re: [PULL REQUEST] Lock down patches

2019-02-28 Thread Mimi Zohar
On Thu, 2019-02-28 at 13:28 -0800, Matthew Garrett wrote: > Hi James, > > David is low on cycles at the moment, so I'm taking over for this time > round. This patchset introduces an optional kernel lockdown feature, > intended to strengthen the boundary between UID 0 and the kernel. When > enabled

[PULL REQUEST] Lock down patches

2019-02-28 Thread Matthew Garrett
Hi James, David is low on cycles at the moment, so I'm taking over for this time round. This patchset introduces an optional kernel lockdown feature, intended to strengthen the boundary between UID 0 and the kernel. When enabled and active (by enabling the config option and passing the "lockdown"