On Fri, Nov 22, 2013 at 05:04:04PM +0100, Jiri Kosina wrote: > On Fri, 22 Nov 2013, Eric Paris wrote: > > > Consider a cloud provider who gives their customer a machine where > > they, the cloud provider, is specifying the kernel and initrd. This > > is a real thing that people do today. Root on the machine has ZERO > > control over the kernel, bootloader, and initrd. Check it out, > > qemu/kvm can do this. But, there is no way to disable kexec if the > > distro configures it in (well, there is in RHEL at least). > > If that root can load LKMs, access /dev/mem, or whatever else, there is > not really a point disabling kexec anyway, is the same thing can be > implemented (although with more hassle, of course) through these channels > as well. I am assuming that in above scenario, kernel will run in locked down mode (something what matthew implemented for secureboot). Where /dev/mem write access will be disabled and only signed modules will be loaded. Thanks Vivek
