Kees Cook <keescook at chromium.org> writes: > For general-purpose (i.e. distro) kernel builds it makes sense to build with > CONFIG_KEXEC to allow end users to choose what kind of things they want to do > with kexec. However, in the face of trying to lock down a system with such > a kernel, there needs to be a way to disable kexec (much like module loading > can be disabled). Without this, it is too easy for the root user to modify > kernel memory even when CONFIG_STRICT_DEVMEM and modules_disabled are > set. So let me get this straight. You object to what happens in sys_reboot so you patch sys_kexec_load? You give someone the privilege to boot whatever they want and yet you don't want to support them booting whatever they want? I'm sorry my brain is hurting trying to understand the logic of this patch. Eric
