Re: IMA: How to manage user space signing policy with others

Mimi Zohar
2013-03-01T01:45:14Z

On Thu, 2013-02-28 at 15:08 -0500, Vivek Goyal wrote:

> - New hook is required so that we can call it after locking down the
> executable in memory. Even if we have a separate method/hook for
> bzImage verification, it does not take away the need for verifying
> /sbin/kexec excutable signature. Because apart from bzImage, that
> process loads lot more information like purgatory, bootparams and
> there is no way to verify signatures of those. So by verifying
> /sbin/kexec it is assumed that purgaotry and bootparams can be
> trusted because it is coming from a signed process.

Ok, this is what I was missing.

thanks,

Mimi