Messages in this thread | | | Date | Fri, 02 Nov 2012 10:54:50 -0600 | From | Chris Friesen <> | Subject | Re: [RFC] Second attempt at kernel secure boot support |
| |
On 11/02/2012 09:48 AM, Vivek Goyal wrote: > On Thu, Nov 01, 2012 at 03:02:25PM -0600, Chris Friesen wrote:
>> With secure boot enabled, then the kernel should refuse to let an >> unsigned kexec load new images, and kexec itself should refuse to >> load unsigned images. > > Yep, good in theory. Now that basically means reimplementing kexec-tools > in kernel.
Maybe I'm missing something, but couldn't the vendors provide a signed kexec? Why does extra stuff need to be pushed into the kernel?
Chris
| |