lkml.org 
[lkml]   [2018]   [Jan]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH 08/30] kexec_file: Restrict at runtime if the kernel is locked down
    Date
    Jiri Bohac <jbohac@suse.cz> wrote:

    > I don't like the idea that the lockdown (which is a runtime
    > thing) requires a compile time option (KEXEC_VERIFY_SIG) that
    > forces the verification even when the kernel is then not locked
    > down at runtime.

    It doesn't. The EPERM only triggers if:

    (1) File signatures aren't mandatory (ie. CONFIG_KEXEC_VERIFY_SIG) is not
    set, and

    (2) you're not using IMA appraisal to validate the file contents, and

    (3) lockdown mode is enabled.

    If file signatures are mandatory or IMA appraisal is in use, then the lockdown
    state doesn't need to be checked.

    David

    \
     
     \ /
      Last update: 2018-01-14 23:23    [W:4.611 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site