4 ms·
Why is this considered a good thing? The only "security" this improves, is of devices where the manufacturer has decided to lock you out!
by keyme 6y ago
Why is this considered a good thing?
The only "security" this improves, is of devices where the manufacturer has decided to lock you out!
- detaro 6y agoWhy doesn't it improve the security of devices where you decide to lock yourself out to protect against faulty applications? Don't you want your hosting provider to lock you and your neighbors out from the kernel running your processes, even if one of you manages to attack a privileged process?
- jcelerier 6y agoapparently some people miss UAC when they use linux
- saagarjha 6y agoIt’s a good thing when you have control over whether it’s enabled, and how.
- paulcarroty 6y agoAll depends from hardware vendor. A lot of modern Android smartphones has encrypted bootloader for example, so, nothing prevent them to lock-in your device right now.
- JackRabbitSlim 6y agoNot exactly. That's why those same vendors work so hard at disabling root access for exactly the reasons outlined by the article; root can wreck it or maybe read out keys, or a million other little things because ALL of it is predicated on no one being able to just arbitrarily read/write to everything on the system like root/uid 1 can do.
- jsiepkes 6y ago> The only "security" this improves, is of devices where the manufacturer has decided to lock you out! Aside from me wanting to be able to verify the integrity of the boot chain and running OS (on platforms like servers, notebooks, etc) this has little to do with manufacturers locking you out. Secure boot is already in all machines and if the manufacturer wants they can already lock you out. They don't a bunch of code in the Linux kernel for that.
- userbinator 6y agoYour second line is the answer to the first. Look at who works on the Linux kernel, and their affiliation, and you will see why things are the way they are.
- mwcampbell 6y agoWe are drowning in cynicism these days. Let's make an effort not to add more.
- soulofmischief 6y agoFrom the post: > Even if root can't modify the on-disk kernel, root can just hot-patch the kernel and then make this persistent by dropping a binary that repeats the process on system boot. Lockdown is intended as a mechanism to avoid that, by providing an optional policy that closes off interfaces that allow root to modify the kernel. > Don't use confidentiality mode in general purpose distributions. The attacks it protects against are mostly against special-purpose use cases, and they can enable it themselves.