| Date | Sat, 21 Oct 2017 03:22:41 +0400 (+04) | From | James Morris <> | Subject | Re: [PATCH 05/27] kexec: Disable at runtime if the kernel is locked down |
| |
On Thu, 19 Oct 2017, David Howells wrote:
> From: Matthew Garrett <matthew.garrett@nebula.com> > > kexec permits the loading and execution of arbitrary code in ring 0, which > is something that lock-down is meant to prevent. It makes sense to disable > kexec in this situation. > > This does not affect kexec_file_load() which can check for a signature on the > image to be booted. > > Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com> > Signed-off-by: David Howells <dhowells@redhat.com> > Acked-by: Dave Young <dyoung@redhat.com> > cc: kexec@lists.infradead.org
Reviewed-by: James Morris <james.l.morris@oracle.com>
-- James Morris <james.l.morris@oracle.com>
|