Re: [PATCH] ima: force signature verification when CONFIG_KEXEC_SIG is configured

2022-07-12 Thread Mimi Zohar
On Tue, 2022-07-12 at 17:33 +0800, Coiby Xu wrote: > Currently, an unsigned kernel could be kexec'ed when IMA arch specific > policy is configured unless lockdown is enabled. Enforce kernel > signature verification check in the kexec_file_load syscall when IMA > arch specific policy is configured.

[PATCH] ima: force signature verification when CONFIG_KEXEC_SIG is configured

2022-07-12 Thread Coiby Xu
Currently, an unsigned kernel could be kexec'ed when IMA arch specific policy is configured unless lockdown is enabled. Enforce kernel signature verification check in the kexec_file_load syscall when IMA arch specific policy is configured. Fixes: 99d5cadfde2b ("kexec_file: split KEXEC_VERIFY_SIG i