3 ms·

> Do not allow direct physical memory access This means someone can't plug in a FireWire/pcie/whatever over usb-c device and read/write any data they want (lik

> Do not allow direct physical memory access This means someone can't plug in a FireWire/pcie/whatever over usb-c device and read/write any data they want (like drive decryption keys). > exposes kernel text image layout. This means if you have a partial exploit but don't know where to jump because of address randomisation, the information is leaked. > Keep root from altering kernel memory via loadable modules. It means you can't plug in a USB device with a known-vulnerable module that gets auto-loaded and leaves your device open. All of the cases of root also mean "user action which triggers a root-level service to execute something". > VMs already can't take over other VMs or the outer system without a vulnerability in the hypervisor. And if it is vulnerable (or more likely, when it's vulnerable) KSPP is the last layer of defence which can prevent the hypervisor from taking over the system. There are reason to enable/disable many of those settings, but none of them are evil.

josephcsible 3y ago
> This means someone can't plug in a FireWire/pcie/whatever over usb-c device and read/write any data they want (like drive decryption keys). You're talking about DMA, but that setting is about /dev/mem. They have nothing in common. > This means if you have a partial exploit but don't know where to jump because of address randomisation, the information is leaked. But /proc/kcore is only readable by root. If an attacker can read that file, I've already lost. > It means you can't plug in a USB device with a known-vulnerable module that gets auto-loaded and leaves your device open. > All of the cases of root also mean "user action which triggers a root-level service to execute something". If automatic loading is really what you're concerned about, you can disable just it with other settings without having to restrict manual actions by root. > And if it is vulnerable (or more likely, when it's vulnerable) KSPP is the last layer of defence which can prevent the hypervisor from taking over the system. That's not how these work. The above settings only affect what root is allowed to do. There are other parts of KSPP that might help with that, but these definitely don't. > There are reason to enable/disable many of those settings, but none of them are evil. They're evil because all they do is limit what root can do, which is useful only for tivoization and not real security.

josephcsible 3y ago

> This means someone can't plug in a FireWire/pcie/whatever over usb-c device and read/write any data they want (like drive decryption keys). You're talking about DMA, but that setting is about /dev/mem. They have nothing in common. > This means if you have a partial exploit but don't know where to jump because of address randomisation, the information is leaked. But /proc/kcore is only readable by root. If an attacker can read that file, I've already lost. > It means you can't plug in a USB device with a known-vulnerable module that gets auto-loaded and leaves your device open. > All of the cases of root also mean "user action which triggers a root-level service to execute something". If automatic loading is really what you're concerned about, you can disable just it with other settings without having to restrict manual actions by root. > And if it is vulnerable (or more likely, when it's vulnerable) KSPP is the last layer of defence which can prevent the hypervisor from taking over the system. That's not how these work. The above settings only affect what root is allowed to do. There are other parts of KSPP that might help with that, but these definitely don't. > There are reason to enable/disable many of those settings, but none of them are evil. They're evil because all they do is limit what root can do, which is useful only for tivoization and not real security.