Hi, On Thu, Nov 21, 2013 at 11:03:50AM -0800, Greg KH wrote: > On Wed, Nov 20, 2013 at 12:50:49PM -0500, Vivek Goyal wrote: > > This patch implements the in kernel kexec functionality. It implements a > > new system call kexec_file_load. I think parameter list of this system > > call will change as I have not done the kernel image signature handling > > yet. I have been told that I might have to pass the detached signature > > and size as part of system call. > > This could be done as we do with modules, and just tack the signature > onto the end of the 'blob' of the image. That way we could use the same > tool to sign the binary as we do for modules, and save the need for > extra parameters in the syscall. As long as the system call passing in an fd, I'm all good. For those of us that run from verified filesystems, we don't need the additional signing overhead, but we do need the file descriptor to validate the origin of the kernel. -Kees -- Kees Cook Chrome OS Security
