On 11/02/2012 09:48 AM, Vivek Goyal wrote:
On Thu, Nov 01, 2012 at 03:02:25PM -0600, Chris Friesen wrote:
With secure boot enabled, then the kernel should refuse to let an
unsigned kexec load new images, and kexec itself should refuse to
load unsigned images.
Yep, good in theory. Now that basically means reimplementing kexec-tools
in kernel.
Maybe I'm missing something, but couldn't the vendors provide a signed
kexec? Why does extra stuff need to be pushed into the kernel?
Chris
--
To unsubscribe from this list: send the line "unsubscribe linux-efi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
