• henfredemars@infosec.pub
    link
    fedilink
    English
    arrow-up
    26
    arrow-down
    1
    ·
    edit-2
    8 months ago

    I’m not sure that’s necessarily true with enforcement of driver signing.

    The latest OS kernels typically make some effort to resist arbitrary code injection even by the system administrator and sometimes goes even further against an attacker with a read/write primitive on the kernel. Linux with secure boot will refuse to load unsigned kernel modules for example.

      • henfredemars@infosec.pub
        link
        fedilink
        English
        arrow-up
        17
        ·
        8 months ago

        You generally cannot load whatever you want into the kernel as admin on Windows.

        You have to either disable secure boot to enable changing it via command prompt, or you have to boot into a special recovery mode first that verifies you have physical access to turn it off.

        Linux with secure boot is similar. Root cannot patch the kernel (without a bug). The kernel lockdown feature is activated, which enforces code signing. You have to use your physical access to change the UEFI setting to disable secure boot first or use a MOK to enable signing your own modules in such a way the secure boot chain accepts them.

        • hddsx@lemmy.ca
          link
          fedilink
          English
          arrow-up
          2
          ·
          8 months ago

          Huh. I must be outdated. I didn’t know they got secure boot working. So what do you do when you need to update your kernel? Or does the fact that it comes from the package manager mean that it is allowed to update that?

          • Kevin@programming.dev
            link
            fedilink
            English
            arrow-up
            4
            ·
            8 months ago

            Generally yes. For many distros, the kernel signing key is with the distro maintainers and so the package comes with pre-signed kernel images. For distros like Arch and Gentoo, it’s the user’s responsibility to maintain the signing key and sign each updated kernel

              • Kevin@programming.dev
                link
                fedilink
                English
                arrow-up
                2
                ·
                8 months ago

                The firmware has to allow it, so if you’ve got physical access to the machine that’s possible. Remote access root, on the other hand, can’t tell the firmware to register new keys as long as it’s configured correctly

          • henfredemars@infosec.pub
            link
            fedilink
            English
            arrow-up
            4
            ·
            8 months ago

            The package manager doesn’t have special permission. The new kernel you download is also signed for you and trusted by your system.

            If it wasn’t trusted, would the next time you boot the kernel won’t load because the bootloader will refuse to load the unsigned code.

      • runefehay@kbin.social
        link
        fedilink
        arrow-up
        14
        ·
        8 months ago

        It is part of the SSSCA / CBDTPA / “Trusted” computing initiative. The large corporations want to control what you are allowed to do with your computer. This is where the phrase “digital rights management” comes from.