Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx> wrote: > > > + if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) && kernel_is_locked_down()) > > > + return -EPERM; > > > + > > > > > IMA can be used to verify file signatures too, based on the LSM hooks > in kernel_read_file_from_fd(). CONFIG_KEXEC_VERIFY_SIG should not be > required. Okay, fair enough. I can stick in an OR with an IS_ENABLED on some IMA symbol. CONFIG_IMA_KEXEC maybe? And also require IMA be enabled? David -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
