Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 07/27] kexec_file: Disable at runtime if securelevel has been set | Date | Thu, 26 Oct 2017 16:02:24 +0100 |
| |
joeyli <jlee@suse.com> wrote:
> + if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) && > + !is_ima_appraise_enabled() && > + kernel_is_locked_down("kexec of unsigned images"))
This doesn't seem right. It seems that you can then kexec unsigned images into a locked-down kernel if IMA appraise is enabled.
I think the commit message needs expansion as to why it's okay. Can you also do it as an additional patch rather than altering the original IMA-less patch 7?
David
| |