From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Garrett Subject: Re: [PATCH V3 08/11] kexec: Disable at runtime if the kernel enforces module loading restrictions Date: Wed, 4 Sep 2013 20:12:09 +0000 Message-ID: <1378325529.13193.8.camel@x230> References: <1378252218-18798-1-git-send-email-matthew.garrett@nebula.com> <1378252218-18798-9-git-send-email-matthew.garrett@nebula.com> <20130904200959.GE8540@anatevka.fc.hp.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20130904200959.GE8540-dMAi7lA+vBPDUbYHzcRnttBPR1lH4CV8@public.gmane.org> Content-Language: en-US Content-ID: <72C1C6130164D64EA8A958B3BA00E179-HX+pjaQZbrqcE4WynfumptQqCkab/8FMAL8bYrjMMd8@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "kexec" Errors-To: kexec-bounces+glkk-kexec=m.gmane.org-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org To: "jerry.hoemann-VXdhtT5mjnY@public.gmane.org" Cc: "linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , "keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org" , kexec , "linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , "hpa-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org" , "vgoyal-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org" List-Id: linux-efi@vger.kernel.org On Wed, 2013-09-04 at 14:09 -0600, jerry.hoemann-VXdhtT5mjnY@public.gmane.org wrote: > On Tue, Sep 03, 2013 at 07:50:15PM -0400, Matthew Garrett wrote: > > kexec permits the loading and execution of arbitrary code in ring 0, which > > is something that module signing enforcement is meant to prevent. It makes > > sense to disable kexec in this situation. > > > > Signed-off-by: Matthew Garrett > > > Matthew, > > Disabling kexec will disable kdump, correct? Yes. > Are there plans to enable kdump on a system where secure > boot is enabled? Yes, Vivek Goyal (cc:ed) is working on that. -- Matthew Garrett