[PATCH 07/27] kexec_file: Disable at runtime if securelevel has been set
flat view
From: dhowells@redhat.com (David Howells)
Date: 2017-10-26 15:02:29
Also in:
linux-efi, lkml
joeyli [off-list ref] wrote:
quoted hunk ↗ jump to hunk
+ if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) && + !is_ima_appraise_enabled() && + kernel_is_locked_down("kexec of unsigned images"))
This doesn't seem right. It seems that you can then kexec unsigned images into a locked-down kernel if IMA appraise is enabled. I think the commit message needs expansion as to why it's okay. Can you also do it as an additional patch rather than altering the original IMA-less patch 7? David -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html