joeyli <[email protected]> wrote: > + if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) && > + !is_ima_appraise_enabled() && > + kernel_is_locked_down("kexec of unsigned images"))
This doesn't seem right. It seems that you can then kexec unsigned images into a locked-down kernel if IMA appraise is enabled. I think the commit message needs expansion as to why it's okay. Can you also do it as an additional patch rather than altering the original IMA-less patch 7? David
