Messages in this thread | | | Subject | Re: [PATCH] ima: force signature verification when CONFIG_KEXEC_SIG is configured | From | Mimi Zohar <> | Date | Tue, 12 Jul 2022 07:40:43 -0400 |
| |
On Tue, 2022-07-12 at 17:33 +0800, Coiby Xu wrote: > Currently, an unsigned kernel could be kexec'ed when IMA arch specific > policy is configured unless lockdown is enabled. Enforce kernel > signature verification check in the kexec_file_load syscall when IMA > arch specific policy is configured. > > Fixes: 99d5cadfde2b ("kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE") > Reported-by: Mimi Zohar <zohar@linux.ibm.com> > Suggested-by: Mimi Zohar <zohar@linux.ibm.com> > Signed-off-by: Coiby Xu <coxu@redhat.com>
Thanks, Coiby. This patch is now queued in next-integrity/next- integrity-testing.
Mimi
| |