[PATCH 05/27] kexec: Disable at runtime if the kernel is locked down

On Thu, 19 Oct 2017, David Howells wrote:

From: Matthew Garrett <redacted>

kexec permits the loading and execution of arbitrary code in ring 0, which
is something that lock-down is meant to prevent. It makes sense to disable
kexec in this situation.

This does not affect kexec_file_load() which can check for a signature on the
image to be booted.

Signed-off-by: Matthew Garrett <redacted>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Dave Young <redacted>
cc: kexec at lists.infradead.org

Reviewed-by: James Morris <redacted>

-- 
James Morris
[off-list ref]

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html