Re: [RFC] Kdump with signed images

2012-10-25 Thread Mimi Zohar
On Thu, 2012-10-25 at 09:54 -0400, Vivek Goyal wrote: > On Thu, Oct 25, 2012 at 01:43:59AM -0400, Mimi Zohar wrote: > > On Wed, 2012-10-24 at 13:19 -0400, Vivek Goyal wrote: > > > On Tue, Oct 23, 2012 at 09:44:59AM -0700, Eric W. Biederman wrote: > > > > Matthew Garrett writes: > > > > > > > > >

Re: [RFC] Kdump with signed images

2012-10-25 Thread Vivek Goyal
On Thu, Oct 25, 2012 at 01:43:59AM -0400, Mimi Zohar wrote: > On Wed, 2012-10-24 at 13:19 -0400, Vivek Goyal wrote: > > On Tue, Oct 23, 2012 at 09:44:59AM -0700, Eric W. Biederman wrote: > > > Matthew Garrett writes: > > > > > > > On Tue, Oct 23, 2012 at 10:59:20AM -0400, Vivek Goyal wrote: > > >

Re: [RFC] Kdump with signed images

2012-10-25 Thread Mimi Zohar
On Wed, 2012-10-24 at 23:44 -0700, Kees Cook wrote: > On Wed, Oct 24, 2012 at 10:43 PM, Mimi Zohar wrote: > > On Wed, 2012-10-24 at 13:19 -0400, Vivek Goyal wrote: > >> On Tue, Oct 23, 2012 at 09:44:59AM -0700, Eric W. Biederman wrote: > >> > Matthew Garrett writes: > >> > > >> > > On Tue, Oct 23

Re: [RFC] Kdump with signed images

2012-10-24 Thread Kees Cook
On Wed, Oct 24, 2012 at 10:43 PM, Mimi Zohar wrote: > On Wed, 2012-10-24 at 13:19 -0400, Vivek Goyal wrote: >> On Tue, Oct 23, 2012 at 09:44:59AM -0700, Eric W. Biederman wrote: >> > Matthew Garrett writes: >> > >> > > On Tue, Oct 23, 2012 at 10:59:20AM -0400, Vivek Goyal wrote: >> > > >> > >> Bu

Re: [RFC] Kdump with signed images

2012-10-24 Thread Mimi Zohar
On Wed, 2012-10-24 at 13:19 -0400, Vivek Goyal wrote: > On Tue, Oct 23, 2012 at 09:44:59AM -0700, Eric W. Biederman wrote: > > Matthew Garrett writes: > > > > > On Tue, Oct 23, 2012 at 10:59:20AM -0400, Vivek Goyal wrote: > > > > > >> But what about creation of a new program which can call kexec_

Re: [RFC] Kdump with signed images

2012-10-24 Thread Vivek Goyal
On Tue, Oct 23, 2012 at 09:44:59AM -0700, Eric W. Biederman wrote: > Matthew Garrett writes: > > > On Tue, Oct 23, 2012 at 10:59:20AM -0400, Vivek Goyal wrote: > > > >> But what about creation of a new program which can call kexec_load() > >> and execute an unsigned kernel. Doesn't look like that