lkml.org 
[lkml]   [2017]   [Oct]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH 07/27] kexec_file: Disable at runtime if securelevel has been set
    Date
    Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

    > Huh?!  With the "secure_boot" policy enabled on the boot command line,
    > IMA-appraisal would verify the kexec kernel image, firmware, kernel
    > modules, and custom IMA policy signatures.

    What happens if the "secure_boot" policy isn't enabled on the boot command
    line? Can you sum up both cases in a paragraph I can add to the patch
    description?

    > Other patches in this patch series need to be updated as well to check
    > if IMA-appraisal is enabled.

    Which exactly? I've added your "!is_ima_appraise_enabled() &&" line to
    kexec_file() and module_sig_check(). Anything else?

    David

    \
     
     \ /
      Last update: 2017-10-30 16:50    [W:3.094 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site