[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 1/3] Move verifiers to the kernel
|
From: |
Matthew Garrett |
|
Subject: |
Re: [PATCH 1/3] Move verifiers to the kernel |
|
Date: |
Thu, 15 Jun 2017 02:48:41 +0100 |
|
User-agent: |
Mutt/1.5.23 (2014-03-12) |
On Wed, Jun 14, 2017 at 06:34:38PM -0700, Vladimir 'phcoder' Serbinenko wrote:
> This bid at odds with the need to keep kernel small. Why not just put
> verifiers as the first module to load? Presumably you need to verify the
> whole core in either case.
They're not useful as an external module, so they need to be built into
the core image in any case (otherwise an attacker just replaces the
verifier module…). And if you're making the ordering significant,
it's far too easy for someone to mess up and end up with an insecure
system as a result.
--
Matthew Garrett | address@hidden
[PATCH 2/3] Verify commands executed by grub, Matthew Garrett, 2017/06/14
[PATCH 3/3] Core TPM support, Matthew Garrett, 2017/06/14