[RFC] Kdump with signed images.
vgoyal at redhat.com
Tue Oct 23 13:39:42 EDT 2012
On Tue, Oct 23, 2012 at 09:26:32AM -0700, Eric W. Biederman wrote:
> > I think this will be a new parallel path and this new path should be taken
> > only on kernel booted with secure boot enabled. (Either automatically or
> > by using some kexec command line option). So nothing should be broken
> > because we never supported anything on secure boot enabled system.
> Rubbish. Kexec works just fine today on a secure boot enabled system.
> Ignoring the nonsense that there is no such thing as a secure boot
> enabled linux system.
I think it is a security hole for the systems where we don't want to run
unsigned priviliged code. So yes, it works as of today, but at some point
of time we shall have to close this hole.
More information about the kexec