From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934239Ab3IDAqq (ORCPT ); Tue, 3 Sep 2013 20:46:46 -0400 Received: from tundra.namei.org ([65.99.196.166]:34548 "EHLO tundra.namei.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934093Ab3IDAqo (ORCPT ); Tue, 3 Sep 2013 20:46:44 -0400 Date: Wed, 4 Sep 2013 10:48:15 +1000 (EST) From: James Morris To: Matthew Garrett cc: linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, keescook@chromium.org, hpa@zytor.com Subject: Re: [PATCH V3 08/11] kexec: Disable at runtime if the kernel enforces module loading restrictions In-Reply-To: <1378252218-18798-9-git-send-email-matthew.garrett@nebula.com> Message-ID: References: <1378252218-18798-1-git-send-email-matthew.garrett@nebula.com> <1378252218-18798-9-git-send-email-matthew.garrett@nebula.com> User-Agent: Alpine 2.02 (LRH 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 3 Sep 2013, Matthew Garrett wrote: > kexec permits the loading and execution of arbitrary code in ring 0, which > is something that module signing enforcement is meant to prevent. It makes > sense to disable kexec in this situation. > > Signed-off-by: Matthew Garrett Reviewed-by: James Morris -- James Morris