Re: Firmware signing -- Re: [PATCH 00/27] security, efi: Add kernel lockdown

[Alan Cox]

On Mon, 13 Nov 2017 14:09:10 -0800
Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:

> On Mon, Nov 13, 2017 at 1:44 PM, David Howells <dhowells@xxxxxxxxxx> wrote:
> >
> > Whilst that may be true, we either have to check signatures on every bit of
> > firmware that the appropriate driver doesn't say is meant to be signed or not
> > bother.  
> 
> I vote for "not bother".
> 
> Seriously, if you have firmware in /lib/firmware, and you don't trust
> it, what the hell are you doing?

Booting a computer 8) - does anyone trust firmware ???


That aside if you can replace the firmware with your own, and your own
firmware compromises the system then you have a privilege escalation from
CAP_SYS_DAC to CAP_SYS_RAWIO just as you do with unsigned modules

(you can't load modules without lots of rights but who cares because you
can simply use cp to put them there with lesser rights and let the kernel
do it).


Alan