Re: [PATCH 23/27] bpf: Restrict kernel image access functions when the kernel is locked down
From: Matthew Garrett <hidden>
Date: 2019-03-26 20:19:27
Also in:
linux-security-module, lkml, netdev
On Tue, Mar 26, 2019 at 11:57 AM James Morris [off-list ref] wrote:
- Assign an ID to each lockdown point - Implement a policy mechanism where each ID is mapped to 0 or 1 - Allow this policy to be specified statically or dynamically
One of the problems with this approach is what the default behaviour should be when a new feature is added. If an admin fails to notice that there's now a new policy element, they run the risk of kernel integrity being compromised via the new feature even if the rest of the kernel is locked down.