Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1754683AbbFQD0W (ORCPT <rfc822;w@1wt.eu>);
	Tue, 16 Jun 2015 23:26:22 -0400
Received: from imap.thunk.org ([74.207.234.97]:39415 "EHLO imap.thunk.org"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1750899AbbFQD0P (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Tue, 16 Jun 2015 23:26:15 -0400
Date: Tue, 16 Jun 2015 23:26:07 -0400
From: "Theodore Ts'o" <tytso@mit.edu>
To: Vivek Goyal <vgoyal@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>,
        Josh Boyer <jwboyer@fedoraproject.org>,
        David Howells <dhowells@redhat.com>, kexec <kexec@lists.infradead.org>,
        "Linux-Kernel@Vger. Kernel. Org" <linux-kernel@vger.kernel.org>,
        Dave Young <dyoung@redhat.com>, Petr Tesarik <ptesarik@suse.cz>
Subject: Re: kexec_load(2) bypasses signature verification
Message-ID: <20150617032607.GC4076@thunk.org>
Mail-Followup-To: Theodore Ts'o <tytso@mit.edu>,
	Vivek Goyal <vgoyal@redhat.com>,
	"Eric W. Biederman" <ebiederm@xmission.com>,
	Josh Boyer <jwboyer@fedoraproject.org>,
	David Howells <dhowells@redhat.com>,
	kexec <kexec@lists.infradead.org>,
	"Linux-Kernel@Vger. Kernel. Org" <linux-kernel@vger.kernel.org>,
	Dave Young <dyoung@redhat.com>, Petr Tesarik <ptesarik@suse.cz>
References: <20150615035051.GA2634@thunk.org>
 <CA+5PVA6t_dEQt1M7HkeHy9znFkPd-a7525vtFq-g4a6VKL+gLQ@mail.gmail.com>
 <20150615131728.GK15793@thunk.org>
 <CA+5PVA6YKR_=uVpM2rW4et3YCJLh9c+uuxt2koH1Fy2ZuR7W-g@mail.gmail.com>
 <20150615200115.GG5003@thunk.org>
 <87zj3zigug.fsf@x220.int.ebiederm.org>
 <20150616202757.GB14943@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20150616202757.GB14943@redhat.com>
User-Agent: Mutt/1.5.23 (2014-03-12)
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: tytso@thunk.org
X-SA-Exim-Scanned: No (on imap.thunk.org); SAEximRunCond expanded to false
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 1541
Lines: 36

On Tue, Jun 16, 2015 at 04:27:57PM -0400, Vivek Goyal wrote:
> 
> So looks like you are looking for a system/option where you just want to
> always make use of kexec_file_load() and disable kexec_load(). This sounds
> like you want a kernel where kexec_load() is compiled out and you want
> only kexec_file_load() in.

Either compiled out or disabled via some flag (similar to how signed
moduled verification can be required via a flag that can be set, but
not unset once it is set), yes.

> Right now one can't do that becase kexec_file_load() depends on
> CONFIG_KEXEC option.
> 
> I am wondering that how about making CONFIG_KEXEC_FILE_LOAD independent
> of CONFIG_KEXEC. That way one can set CONFIG_KEXEC_VERIFY_SIG=y, and
> only signed kernel can be kexeced on that system.

That would certianly also be a workable strategy.

> This should gel well with long term strategy of deprecating kexec_load()
> at some point of time when kexec_file_load() is ready to completely
> replace it.

Well, note that Debian and Ubuntu are still using kexec-tools 2.0.7
(even in their latest development/unstable releases), which doesn't
have support for kexec_file_load().  So we need to get Debian to
upgrade its kexec-tools as part of this.  I'll try to file a
nag-o-gram to the Debian BTS.

						- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/