Re: [PATCH] devcoredump: provide a one-way disable function

2014-11-13 Thread Kees Cook
On Thu, Nov 13, 2014 at 2:36 PM, Johannes Berg wrote: > On Thu, 2014-11-13 at 13:56 -0800, Kees Cook wrote: > >> > + /* >> > +* This essentially makes the attribute write-once, since you can't >> > +* go back to not having it disabled. This is intentional, it >> > serves >>

Re: [PATCH] devcoredump: provide a one-way disable function

2014-11-13 Thread Johannes Berg
On Thu, 2014-11-13 at 13:56 -0800, Kees Cook wrote: > > + /* > > +* This essentially makes the attribute write-once, since you can't > > +* go back to not having it disabled. This is intentional, it serves > > +* as a system lockdown feature. > > +*/ > > +

Re: [PATCH] devcoredump: provide a one-way disable function

2014-11-13 Thread Kees Cook
On Thu, Nov 13, 2014 at 1:16 PM, Johannes Berg wrote: > From: Johannes Berg > > Since device/firmware coredumps can contain private data, it can > be desirable to turn them off unconditionally to be certain that > no such data will be collected by the system. > > To achieve this, provide a "disab

[PATCH] devcoredump: provide a one-way disable function

2014-11-13 Thread Johannes Berg
From: Johannes Berg Since device/firmware coredumps can contain private data, it can be desirable to turn them off unconditionally to be certain that no such data will be collected by the system. To achieve this, provide a "disabled" sysfs class attribute that can only be changed from 0 to 1 and