On Thu, 19 Oct 2017, David Howells wrote: > From: Matthew Garrett <[email protected]> > > kexec permits the loading and execution of arbitrary code in ring 0, which > is something that lock-down is meant to prevent. It makes sense to disable > kexec in this situation. > > This does not affect kexec_file_load() which can check for a signature on the > image to be booted. > > Signed-off-by: Matthew Garrett <[email protected]> > Signed-off-by: David Howells <[email protected]> > Acked-by: Dave Young <[email protected]> > cc: [email protected]
Reviewed-by: James Morris <[email protected]> -- James Morris <[email protected]>
