[PATCH 0/6] kexec: A new system call to allow in kernel loading
jkosina at suse.cz
Fri Nov 22 10:33:46 EST 2013
On Fri, 22 Nov 2013, Geert Uytterhoeven wrote:
> >> Only arm, i386, ppc, ppc64, sh, and x86_64 support zImage.
> >> It's not clear to me what alpha supports (if it supports anything at all?).
> > Motiviation behind this patchset is secureboot. That is x86 specific
> > only and bzImage is most commonly used format on that platform. So it
> > makes sense to implement bzImage loader first, IMO.
> While secureboot(TM) may be x86-centric
And ARM, right?
> IIRC actually loading signed kernels and modules didn't originate on
> x86. Anything can have a bootloader that accepts signed kernel images
Yes, but if you don't have the whole secure boot security model (i.e. root
is implicitly untrusted), it's all just a game really.
If you are playing this "signed kernel and modules" game, but have trusted
root, he's free to replace the bootloader by one that wouldn't be
verifying the kernel signature, and reboot into arbitrary kernel.
More information about the kexec