Re: [PATCH 27/27] kexec: Allow kexec_file() with appropriate IMA policy when locked down

On Mon, 2019-03-25 at 15:09 -0700, Matthew Garrett wrote: > Systems in lockdown mode should block the kexec of untrusted kernels. > For x86 and ARM we can ensure that a kernel is trustworthy by validating > a PE signature, but this isn't possible on other architectures. On those > platforms we can

[PATCH 27/27] kexec: Allow kexec_file() with appropriate IMA policy when locked down

Systems in lockdown mode should block the kexec of untrusted kernels. For x86 and ARM we can ensure that a kernel is trustworthy by validating a PE signature, but this isn't possible on other architectures. On those platforms we can use IMA digital signatures instead. Add a function to determine wh