Re: [PATCH V31 10/25] PCI: Lock down BAR access when the kernel is locked down

2019-03-26 Thread Alex Williamson
On Tue, 26 Mar 2019 13:55:39 -0700 Andy Lutomirski wrote: > On Tue, Mar 26, 2019 at 11:28 AM Matthew Garrett > wrote: > > > > From: Matthew Garrett > > > > Any hardware that can potentially generate DMA has to be locked down in > > order to avoid it being possible for an attacker to modify kern

Re: [PATCH V31 10/25] PCI: Lock down BAR access when the kernel is locked down

2019-03-26 Thread Andy Lutomirski
On Tue, Mar 26, 2019 at 11:28 AM Matthew Garrett wrote: > > From: Matthew Garrett > > Any hardware that can potentially generate DMA has to be locked down in > order to avoid it being possible for an attacker to modify kernel code, > allowing them to circumvent disabled module loading or module s

[PATCH V31 10/25] PCI: Lock down BAR access when the kernel is locked down

2019-03-26 Thread Matthew Garrett
From: Matthew Garrett Any hardware that can potentially generate DMA has to be locked down in order to avoid it being possible for an attacker to modify kernel code, allowing them to circumvent disabled module loading or module signing. Default to paranoid - in future we can potentially relax thi