lkml.org 
[lkml]   [2022]   [Feb]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] kexec: move KEXEC_SIG_FORCE from arch/x86 to arch
On Thu, Feb 10, 2022 at 02:16:48PM +0100, Michal Suchanek wrote:
> There is nothing x86-specific about KEXEC_SIG_FORCE
>
> Signed-off-by: Michal Suchanek <msuchanek@suse.de>
> ---
> arch/Kconfig | 7 +++++++
> arch/x86/Kconfig | 7 -------
> 2 files changed, 7 insertions(+), 7 deletions(-)
>
> diff --git a/arch/Kconfig b/arch/Kconfig
> index 678a80713b21..dc2446f01ac1 100644
> --- a/arch/Kconfig
> +++ b/arch/Kconfig
> @@ -24,6 +24,13 @@ config KEXEC_ELF
> config HAVE_IMA_KEXEC
> bool
>
> +config KEXEC_SIG_FORCE
> + bool "Require a valid signature in kexec_file_load() syscall"
> + depends on KEXEC_SIG
> + help
> + This option makes kernel signature verification mandatory for
> + the kexec_file_load() syscall.
> +
> config SET_FS
> bool
>
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index 9f5bd41bf660..3ea648dad6b6 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -2032,13 +2032,6 @@ config KEXEC_SIG
> verification for the corresponding kernel image type being
> loaded in order for this to work.
>
> -config KEXEC_SIG_FORCE
> - bool "Require a valid signature in kexec_file_load() syscall"
> - depends on KEXEC_SIG
> - help
> - This option makes kernel signature verification mandatory for
> - the kexec_file_load() syscall.
> -

This means it is no longer folded under KEXEC_SIG in menuconfig,
which makes it harder to find. I would prefer seeing KEXEC_SIG (and
KEXEC_SIG_FORCE) moved out of the per-arch Kconfig files into a common
location, and then arch Kconfig can add something like:

select ARCH_SUPPORTS_KEXEC

> config KEXEC_BZIMAGE_VERIFY_SIG
> bool "Enable bzImage signature verification support"
> depends on KEXEC_SIG
> --
> 2.31.1
>

--
Kees Cook

\
 
 \ /
  Last update: 2022-02-10 18:34    [W:2.884 / U:0.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site