[PATCH 09/24] kexec_file: Disable at runtime if securelevel has been set

Mimi Zohar zohar at linux.vnet.ibm.com
Tue May 2 12:01:22 PDT 2017

Hi David,

On Mon, 2017-04-10 at 14:19 +0100, David Howells wrote:
> Mimi Zohar <zohar at linux.vnet.ibm.com> wrote:
> > From an IMA perspective, either a file hash or signature are valid,
> > but for this usage it must be a signature.
> Not necessarily.  If IMA can guarantee that a module is the same based on its
> hash rather than on a key, I would've thought that should be fine.

File hashes can be modified on the running system, so they're normally
used, in conjunction with EVM, to detect off line modification of
mutable files and prevent their usage.

These patches https://lkml.org/lkml/2017/5/2/465 should provide some
of the missing functionality.


More information about the kexec mailing list