4 ms·
Since this is controlled via a kernel parameter, can root just unset the kernel parameter and reboot? Or are there systems where kernel parameters are also 'loc
by rrss 6y ago
Since this is controlled via a kernel parameter, can root just unset the kernel parameter and reboot? Or are there systems where kernel parameters are also 'locked down' by some other mechanism?
(these are genuine questions - I don't know much about linux security and am seeking to understand).
- diath 6y agoI believe it's a set of kernel build flags and not a kernel parameter, in which case, not really, I initially said you could just replace the kernel with something that's been built without the flags and reboot but apparently the second paragraph says it prevents that, though I'm not sure how would updating the kernel work in that case then.
- rrss 6y agoThere are build config options, but there's also a kernel parameter > lockdown= [SECURITY] { integrity | confidentiality } https://www.kernel.org/doc/Documentation/admin-guide/kernel-parameters.txt https://www.kernel.org/doc/Documentation/admin-guide/kernel-...
- diath 6y agoI missed that part, so I'm honestly as puzzled as you are (I suppose the answer would be yes then).
- Spivak 6y agoYou need GRUB's help do do this. There is a 'verify' module you can use that makes GRUB load files that are signed with a given GPG key. You build a GRUB efi binary that contains your key and only loads signed config files, initrds, and kernels and then sign that binary so that it can be loaded by UEFI.
- mjg59 6y agoMost distributions carry a patch to automatically enable this if you have a verified boot process. Otherwise, it's up to the admin to ensure that their verified boot process applies the appropriate policy (eg, by ensuring that your bootloader appends the argument regardless of configuration)
- rrss 6y agoThanks!