* Re: [PATCH V3 08/11] kexec: Disable at runtime if the kernel enforces module loading restrictions
[not found] ` <20130904200959.GE8540@anatevka.fc.hp.com>
@ 2013-09-04 20:12 ` Matthew Garrett
2013-09-04 20:14 ` Josh Boyer
1 sibling, 0 replies; 2+ messages in thread
From: Matthew Garrett @ 2013-09-04 20:12 UTC (permalink / raw)
To: jerry.hoemann@hp.com
Cc: linux-efi@vger.kernel.org, keescook@chromium.org, kexec,
linux-kernel@vger.kernel.org, hpa@zytor.com, vgoyal@redhat.com
On Wed, 2013-09-04 at 14:09 -0600, jerry.hoemann@hp.com wrote:
> On Tue, Sep 03, 2013 at 07:50:15PM -0400, Matthew Garrett wrote:
> > kexec permits the loading and execution of arbitrary code in ring 0, which
> > is something that module signing enforcement is meant to prevent. It makes
> > sense to disable kexec in this situation.
> >
> > Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
>
>
> Matthew,
>
> Disabling kexec will disable kdump, correct?
Yes.
> Are there plans to enable kdump on a system where secure
> boot is enabled?
Yes, Vivek Goyal (cc:ed) is working on that.
--
Matthew Garrett <matthew.garrett@nebula.com>
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH V3 08/11] kexec: Disable at runtime if the kernel enforces module loading restrictions
[not found] ` <20130904200959.GE8540@anatevka.fc.hp.com>
2013-09-04 20:12 ` [PATCH V3 08/11] kexec: Disable at runtime if the kernel enforces module loading restrictions Matthew Garrett
@ 2013-09-04 20:14 ` Josh Boyer
1 sibling, 0 replies; 2+ messages in thread
From: Josh Boyer @ 2013-09-04 20:14 UTC (permalink / raw)
To: jerry.hoemann
Cc: Matthew Garrett, linux-efi@vger.kernel.org, Kees Cook, kexec,
Linux-Kernel@Vger. Kernel. Org, H. Peter Anvin, Vivek Goyal
On Wed, Sep 4, 2013 at 4:09 PM, <jerry.hoemann@hp.com> wrote:
> On Tue, Sep 03, 2013 at 07:50:15PM -0400, Matthew Garrett wrote:
>> kexec permits the loading and execution of arbitrary code in ring 0, which
>> is something that module signing enforcement is meant to prevent. It makes
>> sense to disable kexec in this situation.
>>
>> Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
>
>
> Matthew,
>
> Disabling kexec will disable kdump, correct?
Yes.
> Are there plans to enable kdump on a system where secure
> boot is enabled?
Vivek Goyal has been working on this. I've not seen the code yet, but
I believe it should be posted somewhere relatively soon. We're also
planning on talking about it at the Secure Boot microconference at
Linux Plumbers in two weeks.
josh
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-09-04 20:14 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <1378252218-18798-1-git-send-email-matthew.garrett@nebula.com>
[not found] ` <1378252218-18798-9-git-send-email-matthew.garrett@nebula.com>
[not found] ` <20130904200959.GE8540@anatevka.fc.hp.com>
2013-09-04 20:12 ` [PATCH V3 08/11] kexec: Disable at runtime if the kernel enforces module loading restrictions Matthew Garrett
2013-09-04 20:14 ` Josh Boyer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox