> It's an argument that CAP_SYS_BOOT is too powerful yes, but if you
> recall, I said I keep that one.  In the rather lame analogy, what I do
> by giving away CAP_SYS_MODULE and enforcing module signing while keeping
> CAP_SYS_BOOT is allow people into my conservatory to play with the
> plants but not into my house to steal the silver ... saying CAP_SYS_BOOT
> is too powerful doesn't affect that use case because I haven't given
> away CAP_SYS_BOOT.

Ok, sorry, I had your meaning inverted. Yes, permitting the loading of
signed modules while preventing the use of kexec is a completely
reasonable configuration - so reasonable that it's what this patch
causes the kernel to do automatically. 

-- 
Matthew Garrett <matthew.garrett@nebula.com>
���{.n�+�������+%�����ݶ��w��{.n�+����{��G�����{ay�ʇڙ�,j��f���h��������z_�(�階�ݢj"���m������G������?����&���~��iO��z��v�^�m����������?�I�