[PATCH 09/24] kexec_file: Disable at runtime if securelevel has been set
David Howells
dhowells at redhat.com
Fri Apr 7 07:09:54 UTC 2017
Mimi Zohar <zohar at linux.vnet.ibm.com> wrote:
> > > + if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) && kernel_is_locked_down())
> > > + return -EPERM;
> > > +
> > >
>
> IMA can be used to verify file signatures too, based on the LSM hooks
> in kernel_read_file_from_fd(). CONFIG_KEXEC_VERIFY_SIG should not be
> required.
Okay, fair enough. I can stick in an OR with an IS_ENABLED on some IMA
symbol. CONFIG_IMA_KEXEC maybe? And also require IMA be enabled?
David
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
More information about the Linux-security-module-archive
mailing list