[PATCH 09/24] kexec_file: Disable at runtime if securelevel has been set
zohar at linux.vnet.ibm.com
Fri Apr 7 00:46:20 PDT 2017
On Fri, 2017-04-07 at 08:09 +0100, David Howells wrote:
> Mimi Zohar <zohar at linux.vnet.ibm.com> wrote:
> > > > + if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) && kernel_is_locked_down())
> > > > + return -EPERM;
> > > > +
> > > >
> > IMA can be used to verify file signatures too, based on the LSM hooks
> > in kernel_read_file_from_fd(). CONFIG_KEXEC_VERIFY_SIG should not be
> > required.
> Okay, fair enough. I can stick in an OR with an IS_ENABLED on some IMA
> symbol. CONFIG_IMA_KEXEC maybe? And also require IMA be enabled?
Not quite, since as Dave pointed out, IMA is policy driven. As a
policy is installed, we could set a flag.
More information about the kexec