Re: [PATCH 12/24] PCI: Lock down BAR access when the kernel is locked down

2017-04-18 Thread Bjorn Helgaas
On Wed, Apr 05, 2017 at 09:16:18PM +0100, David Howells wrote: > From: Matthew Garrett > > Any hardware that can potentially generate DMA has to be locked down in > order to avoid it being possible for an attacker to modify kernel code, > allowing them to circumvent

Re: [PATCH 12/24] PCI: Lock down BAR access when the kernel is locked down

2017-04-18 Thread Bjorn Helgaas
On Wed, Apr 05, 2017 at 09:16:18PM +0100, David Howells wrote: > From: Matthew Garrett > > Any hardware that can potentially generate DMA has to be locked down in > order to avoid it being possible for an attacker to modify kernel code, > allowing them to circumvent disabled module loading or

[PATCH 12/24] PCI: Lock down BAR access when the kernel is locked down

2017-04-05 Thread David Howells
From: Matthew Garrett Any hardware that can potentially generate DMA has to be locked down in order to avoid it being possible for an attacker to modify kernel code, allowing them to circumvent disabled module loading or module signing. Default to paranoid - in future

[PATCH 12/24] PCI: Lock down BAR access when the kernel is locked down

2017-04-05 Thread David Howells
From: Matthew Garrett Any hardware that can potentially generate DMA has to be locked down in order to avoid it being possible for an attacker to modify kernel code, allowing them to circumvent disabled module loading or module signing. Default to paranoid - in future we can potentially relax

[PATCH 12/24] PCI: Lock down BAR access when the kernel is locked down

2017-04-05 Thread David Howells
From: Matthew Garrett Any hardware that can potentially generate DMA has to be locked down in order to avoid it being possible for an attacker to modify kernel code, allowing them to circumvent disabled module loading or module signing. Default to paranoid - in future

[PATCH 12/24] PCI: Lock down BAR access when the kernel is locked down

2017-04-05 Thread David Howells
From: Matthew Garrett Any hardware that can potentially generate DMA has to be locked down in order to avoid it being possible for an attacker to modify kernel code, allowing them to circumvent disabled module loading or module signing. Default to paranoid - in future we can potentially relax