From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from mail-bl2lp0203.outbound.protection.outlook.com ([207.46.163.203] helo=na01-bl2-obe.outbound.protection.outlook.com) by merlin.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1VHJRO-0007GX-9L for kexec@lists.infradead.org; Wed, 04 Sep 2013 20:12:39 +0000 From: Matthew Garrett Subject: Re: [PATCH V3 08/11] kexec: Disable at runtime if the kernel enforces module loading restrictions Date: Wed, 4 Sep 2013 20:12:09 +0000 Message-ID: <1378325529.13193.8.camel@x230> References: <1378252218-18798-1-git-send-email-matthew.garrett@nebula.com> <1378252218-18798-9-git-send-email-matthew.garrett@nebula.com> <20130904200959.GE8540@anatevka.fc.hp.com> In-Reply-To: <20130904200959.GE8540@anatevka.fc.hp.com> Content-Language: en-US Content-ID: <72C1C6130164D64EA8A958B3BA00E179@namprd05.prod.outlook.com> MIME-Version: 1.0 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "kexec" Errors-To: kexec-bounces+dwmw2=twosheds.infradead.org@lists.infradead.org To: "jerry.hoemann@hp.com" Cc: "linux-efi@vger.kernel.org" , "keescook@chromium.org" , kexec , "linux-kernel@vger.kernel.org" , "hpa@zytor.com" , "vgoyal@redhat.com" On Wed, 2013-09-04 at 14:09 -0600, jerry.hoemann@hp.com wrote: > On Tue, Sep 03, 2013 at 07:50:15PM -0400, Matthew Garrett wrote: > > kexec permits the loading and execution of arbitrary code in ring 0, which > > is something that module signing enforcement is meant to prevent. It makes > > sense to disable kexec in this situation. > > > > Signed-off-by: Matthew Garrett > > > Matthew, > > Disabling kexec will disable kdump, correct? Yes. > Are there plans to enable kdump on a system where secure > boot is enabled? Yes, Vivek Goyal (cc:ed) is working on that. -- Matthew Garrett _______________________________________________ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Garrett Subject: Re: [PATCH V3 08/11] kexec: Disable at runtime if the kernel enforces module loading restrictions Date: Wed, 4 Sep 2013 20:12:09 +0000 Message-ID: <1378325529.13193.8.camel@x230> References: <1378252218-18798-1-git-send-email-matthew.garrett@nebula.com> <1378252218-18798-9-git-send-email-matthew.garrett@nebula.com> <20130904200959.GE8540@anatevka.fc.hp.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20130904200959.GE8540-dMAi7lA+vBPDUbYHzcRnttBPR1lH4CV8@public.gmane.org> Content-Language: en-US Content-ID: <72C1C6130164D64EA8A958B3BA00E179-HX+pjaQZbrqcE4WynfumptQqCkab/8FMAL8bYrjMMd8@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "kexec" Errors-To: kexec-bounces+glkk-kexec=m.gmane.org-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org To: "jerry.hoemann-VXdhtT5mjnY@public.gmane.org" Cc: "linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , "keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org" , kexec , "linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , "hpa-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org" , "vgoyal-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org" List-Id: linux-efi@vger.kernel.org On Wed, 2013-09-04 at 14:09 -0600, jerry.hoemann-VXdhtT5mjnY@public.gmane.org wrote: > On Tue, Sep 03, 2013 at 07:50:15PM -0400, Matthew Garrett wrote: > > kexec permits the loading and execution of arbitrary code in ring 0, which > > is something that module signing enforcement is meant to prevent. It makes > > sense to disable kexec in this situation. > > > > Signed-off-by: Matthew Garrett > > > Matthew, > > Disabling kexec will disable kdump, correct? Yes. > Are there plans to enable kdump on a system where secure > boot is enabled? Yes, Vivek Goyal (cc:ed) is working on that. -- Matthew Garrett From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933017Ab3IDUMs (ORCPT ); Wed, 4 Sep 2013 16:12:48 -0400 Received: from mail-bl2lp0208.outbound.protection.outlook.com ([207.46.163.208]:9187 "EHLO na01-bl2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932888Ab3IDUMP (ORCPT ); Wed, 4 Sep 2013 16:12:15 -0400 From: Matthew Garrett To: "jerry.hoemann@hp.com" CC: "linux-kernel@vger.kernel.org" , "linux-efi@vger.kernel.org" , "keescook@chromium.org" , "hpa@zytor.com" , kexec , "vgoyal@redhat.com" Subject: Re: [PATCH V3 08/11] kexec: Disable at runtime if the kernel enforces module loading restrictions Thread-Topic: [PATCH V3 08/11] kexec: Disable at runtime if the kernel enforces module loading restrictions Thread-Index: AQHOqQBlTgRtcELUZ0K5HxHj5bQ8FZm2A3WAgAAAm4A= Date: Wed, 4 Sep 2013 20:12:09 +0000 Message-ID: <1378325529.13193.8.camel@x230> References: <1378252218-18798-1-git-send-email-matthew.garrett@nebula.com> <1378252218-18798-9-git-send-email-matthew.garrett@nebula.com> <20130904200959.GE8540@anatevka.fc.hp.com> In-Reply-To: <20130904200959.GE8540@anatevka.fc.hp.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [209.6.207.143] x-forefront-prvs: 095972DF2F x-forefront-antispam-report: SFV:NSPM;SFS:(189002)(199002)(377424004)(51704005)(24454002)(74706001)(19580405001)(83322001)(56816003)(77096001)(47446002)(31966008)(74502001)(74662001)(74366001)(19580395003)(53806001)(80976001)(69226001)(76796001)(76786001)(33646001)(81816001)(65816001)(81686001)(66066001)(33716001)(83072001)(80022001)(51856001)(4396001)(59766001)(77982001)(46102001)(76482001)(54356001)(74876001)(56776001)(63696002)(54316002)(81542001)(79102001)(81342001)(47736001)(49866001)(47976001)(50986001);DIR:OUT;SFP:;SCL:1;SRVR:BY2PR05MB224;H:BY2PR05MB222.namprd05.prod.outlook.com;CLIP:209.6.207.143;RD:InfoNoRecords;MX:1;A:1;LANG:en; Content-Type: text/plain; charset="utf-8" Content-ID: <72C1C6130164D64EA8A958B3BA00E179@namprd05.prod.outlook.com> MIME-Version: 1.0 X-OriginatorOrg: nebula.com Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by mail.home.local id r84KCrXj025528 On Wed, 2013-09-04 at 14:09 -0600, jerry.hoemann@hp.com wrote: > On Tue, Sep 03, 2013 at 07:50:15PM -0400, Matthew Garrett wrote: > > kexec permits the loading and execution of arbitrary code in ring 0, which > > is something that module signing enforcement is meant to prevent. It makes > > sense to disable kexec in this situation. > > > > Signed-off-by: Matthew Garrett > > > Matthew, > > Disabling kexec will disable kdump, correct? Yes. > Are there plans to enable kdump on a system where secure > boot is enabled? Yes, Vivek Goyal (cc:ed) is working on that. -- Matthew Garrett {.n++%ݶw{.n+{G{ayʇڙ,jfhz_(階ݢj"mG?&~iOzv^m ?I