lkml.org 
[lkml]   [2017]   [Oct]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH 07/27] kexec_file: Disable at runtime if securelevel has been set
Date
Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> Huh?!  With the "secure_boot" policy enabled on the boot command line,
> IMA-appraisal would verify the kexec kernel image, firmware, kernel
> modules, and custom IMA policy signatures.

What happens if the "secure_boot" policy isn't enabled on the boot command
line? Can you sum up both cases in a paragraph I can add to the patch
description?

> Other patches in this patch series need to be updated as well to check
> if IMA-appraisal is enabled.

Which exactly? I've added your "!is_ima_appraise_enabled() &&" line to
kexec_file() and module_sig_check(). Anything else?

David

\
 
 \ /
  Last update: 2017-10-30 16:50    [W:0.293 / U:25.640 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site