Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754557AbbFRBZu (ORCPT ); Wed, 17 Jun 2015 21:25:50 -0400 Received: from mx1.redhat.com ([209.132.183.28]:55309 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751363AbbFRBZn (ORCPT ); Wed, 17 Jun 2015 21:25:43 -0400 Date: Thu, 18 Jun 2015 09:25:36 +0800 From: Dave Young To: "Theodore Ts'o" , Josh Boyer , Eric Biederman , David Howells , kexec , "Linux-Kernel@Vger. Kernel. Org" Subject: Re: kexec_load(2) bypasses signature verification Message-ID: <20150618012536.GC8718@dhcp-128-32.nay.redhat.com> References: <20150615035051.GA2634@thunk.org> <20150615131728.GK15793@thunk.org> <20150615200115.GG5003@thunk.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150615200115.GG5003@thunk.org> User-Agent: Mutt/1.5.22.1-rc1 (2013-10-16) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1154 Lines: 25 On 06/15/15 at 04:01pm, Theodore Ts'o wrote: > On Mon, Jun 15, 2015 at 09:37:05AM -0400, Josh Boyer wrote: > > The bits that actually read Secure Boot state out of the UEFI > > variables, and apply protections to the machine to avoid compromise > > under the SB threat model. Things like disabling the old kexec... > > I don't have any real interest in using Secure Boot, but I *am* > interested in using CONFIG_KEXEC_VERIFY_SIG[1]. So perhaps we need to > have something similar to what we have with signed modules in terms of > CONFIG_MODULE_SIG_FORCE and module/sig_enforce, but for > KEXEC_VERIFY_SIG. This would mean creating a separate flag > independent of the one Linus suggested for Secure Boot, but since we > have one for signed modules, we do have precedent for this sort of > thing. Agree and vote for this way as I replied in another email about CONFIG_KEXEC_VERIFY_SIG_FORCE. Thanks Dave -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/