Re: [PATCH v2 1/2] powerpc/pseries: block untrusted device tree changes when locked down

2022-09-28 Thread Andrew Donnellan
On Mon, 2022-09-26 at 08:16 -0500, Nathan Lynch wrote: > The /proc/powerpc/ofdt interface allows the root user to freely alter > the in-kernel device tree, enabling arbitrary physical address writes > via drivers that could bind to malicious device nodes, thus making it > possible to disable lockdo

Re: [PATCH v2 1/2] powerpc/pseries: block untrusted device tree changes when locked down

2022-09-26 Thread Paul Moore
On Mon, Sep 26, 2022 at 9:17 AM Nathan Lynch wrote: > > The /proc/powerpc/ofdt interface allows the root user to freely alter > the in-kernel device tree, enabling arbitrary physical address writes > via drivers that could bind to malicious device nodes, thus making it > possible to disable lockdo

[PATCH v2 1/2] powerpc/pseries: block untrusted device tree changes when locked down

2022-09-26 Thread Nathan Lynch
The /proc/powerpc/ofdt interface allows the root user to freely alter the in-kernel device tree, enabling arbitrary physical address writes via drivers that could bind to malicious device nodes, thus making it possible to disable lockdown. Historically this interface has been used on the pseries p