lkml.org 
[lkml]   [2013]   [Nov]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 0/6] kexec: A new system call to allow in kernel loading
On Fri, 22 Nov 2013, Geert Uytterhoeven wrote:

> >> Only arm, i386, ppc, ppc64, sh, and x86_64 support zImage.
> >> It's not clear to me what alpha supports (if it supports anything at all?).
> >
> > Motiviation behind this patchset is secureboot. That is x86 specific
> > only and bzImage is most commonly used format on that platform. So it
> > makes sense to implement bzImage loader first, IMO.
>
> While secureboot(TM) may be x86-centric

And ARM, right?

> IIRC actually loading signed kernels and modules didn't originate on
> x86. Anything can have a bootloader that accepts signed kernel images
> only.

Yes, but if you don't have the whole secure boot security model (i.e. root
is implicitly untrusted), it's all just a game really.

If you are playing this "signed kernel and modules" game, but have trusted
root, he's free to replace the bootloader by one that wouldn't be
verifying the kernel signature, and reboot into arbitrary kernel.

--
Jiri Kosina
SUSE Labs



\
 
 \ /
  Last update: 2013-11-22 17:21    [W:0.121 / U:0.212 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site