On Mon, Jun 24, 2019 at 2:27 PM Mimi Zohar <zohar@xxxxxxxxxxxxx> wrote: > I agree with Dave. There should be a stub lockdown function to > prevent enforcing lockdown when it isn't enabled. Sorry, when what isn't enabled? If no LSMs are enforcing lockdown then the check will return 0. The goal here is for distributions to be able to ship a kernel that has CONFIG_KEXEC_SIG=y, CONFIG_KEXEC_SIG_FORCE=n and at runtime be able to enforce a policy that requires signatures on kexec payloads.
