Re: [PATCH v2] ima: force signature verification when CONFIG_KEXEC_SIG is configured

2022-07-13 Thread Mimi Zohar
On Wed, 2022-07-13 at 15:21 +0800, Coiby Xu wrote: > Currently, an unsigned kernel could be kexec'ed when IMA arch specific > policy is configured unless lockdown is enabled. Enforce kernel > signature verification check in the kexec_file_load syscall when IMA > arch specific policy is configured.

[PATCH v2] ima: force signature verification when CONFIG_KEXEC_SIG is configured

2022-07-13 Thread Coiby Xu
Currently, an unsigned kernel could be kexec'ed when IMA arch specific policy is configured unless lockdown is enabled. Enforce kernel signature verification check in the kexec_file_load syscall when IMA arch specific policy is configured. Fixes: 99d5cadfde2b ("kexec_file: split KEXEC_VERIFY_SIG i