LWN: Comments on "Integrity management in the kernel"

Kernel lockdown

jospoortvliet — Thu, 03 May 2007 10:09:23 +0000

yeah, reading about these patches gives a distinct feeling the most important usecase is locking the user into certain software, eg Tivio-like stuff. I don't like it... It's lovely to be able to check if your server has been compromised, but it's a bit TOO lovely to be able to see if a user has modified any of the software on the device he/she bought from you, and deny his/her right to use it based on that.

Ineffective as a DRM / other checking component

pimlott — Wed, 11 Apr 2007 18:19:34 +0000

Hmm, good point. Lazy evaluation strikes again.

Ineffective as a DRM / other checking component

droundy — Wed, 11 Apr 2007 18:01:15 +0000

Except that it'd be horrifically expensive to checksum the entire system at startup. It looks like this approach would allow a trusted startup without having to check everything.

Ineffective as a DRM / other checking component

pimlott — Fri, 06 Apr 2007 03:12:04 +0000

It isn't intended to protect against vulnerabilities in the kernel (as I read the description), but rather to protect against offline compromise

Then there's no point in verifying checksums except at start-up. The code to do so can either go in the firmware/BIOS, or run in the kernel on boot. The on-line checks may be valuable for detecting errors, but not attacks.

Ineffective as a DRM / other checking component

droundy — Tue, 03 Apr 2007 14:39:11 +0000

It isn't intended to protect against vulnerabilities in the kernel (as I read the description), but rather to protect against offline compromise, as described in the article. This is a real protection, albeit not against the most common threat.

Of course, you might be able to achieve the same safety using BIOS settings that require a password to modify those settings themselves and disable booting from external media, and you lock the box itself with an alarm system (to keep bad guys from removing the hard disk and sticking it in another computer to modify its contents). But that seems a bit more complicated, to me, than just having a chip on the motherboard that stores checksums.

Ineffective as a DRM / other checking component

hummassa — Thu, 29 Mar 2007 11:48:31 +0000

Take the following path:
1. inject some code into kernelspace, via known vulnerability;
2. this code makes the kernel present to the TPM (*) the original file to
generate the signature (that will be sent to the network), but execute
another file altogether;
3. ...
4. Profit!!!
:-)
Sorry for the /.-ism, but that's it. This should be kept out of the
kernel, not because of its immorality, but because of its ineffectivity.
(*) funny thing is, in Portuguese, this is the acronym to PMS :-)

Kernel lockdown

ldo — Thu, 29 Mar 2007 08:25:57 +0000

... and so, in spite of the protestations of kernel developers, GPLv3 becomes more and more attractive ...

Integrity management in the kernel

flewellyn — Thu, 29 Mar 2007 05:40:31 +0000

"Mainline confusion"?