On Fri, 2017-04-07 at 08:09 +0100, David Howells wrote: > Mimi Zohar <zo...@linux.vnet.ibm.com> wrote: > > > > > + if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) && > > > > kernel_is_locked_down()) > > > > + return -EPERM; > > > > + > > > > > > > > IMA can be used to verify file signatures too, based on the LSM hooks > > in kernel_read_file_from_fd(). CONFIG_KEXEC_VERIFY_SIG should not be > > required. > > Okay, fair enough. I can stick in an OR with an IS_ENABLED on some IMA > symbol. CONFIG_IMA_KEXEC maybe? And also require IMA be enabled?
Not quite, since as Dave pointed out, IMA is policy driven. As a policy is installed, we could set a flag. Mimi
