From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from terminus.zytor.com ([2001:1868:205::10] helo=mail.zytor.com) by merlin.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1VypKo-0004jG-8q for kexec@lists.infradead.org; Thu, 02 Jan 2014 20:57:43 +0000 Message-ID: <52C5D28F.6030008@zytor.com> Date: Thu, 02 Jan 2014 12:56:47 -0800 From: "H. Peter Anvin" MIME-Version: 1.0 Subject: Re: [PATCH 4/6] kexec: A new system call, kexec_file_load, for in kernel kexec References: <20131121191907.GA26366@srcf.ucam.org> <20131122185706.GK4046@redhat.com> <87vbzju6ql.fsf@xmission.com> <20131125163920.GC23094@redhat.com> <87fvqj2vxz.fsf@xmission.com> <20131126142759.GA5473@redhat.com> <20131219125439.GA6379@lst.de> <20131220141917.GB27063@redhat.com> <87a9fvqfs4.fsf@xmission.com> <20140102203912.GB22822@redhat.com> In-Reply-To: <20140102203912.GB22822@redhat.com> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "kexec" Errors-To: kexec-bounces+dwmw2=twosheds.infradead.org@lists.infradead.org To: Vivek Goyal , Kees Cook Cc: Matthew Garrett , Greg KH , kexec@lists.infradead.org, LKML , Peter Jones , Torsten Duwe , "Eric W. Biederman" On 01/02/2014 12:39 PM, Vivek Goyal wrote: > > If secureboot is enabled, it enforces module signature verification. I > think similar will happen for kexec too. How would kernel know that on > a secureboot platform fd original verification will happen and it is > sufficient. > > I personally want to support bzImage as well (apart from ELF) because > distributions has been shipping bzImage for a long time and I don't > want to enforce a change there because of secureboot. It is not necessary. > Right now I am thinking more about storing detached bzImage signatures > and passing those signatures to kexec system call. > Since the secureboot scenario probably means people will be signing those kernels, and those kernels are going to be EFI images, that in order to have "one kernel, one signature" there will be a desire to support signed PE images. Yes, PE is ugly but it shouldn't be too bad. However, it is probably one of those things that can be dealt with one bit at a time. -hpa _______________________________________________ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec