On Thu, 19 Oct 2017, David Howells wrote: > From: Matthew Garrett <matthew.garrett@xxxxxxxxxx> > > kexec permits the loading and execution of arbitrary code in ring 0, which > is something that lock-down is meant to prevent. It makes sense to disable > kexec in this situation. > > This does not affect kexec_file_load() which can check for a signature on the > image to be booted. > > Signed-off-by: Matthew Garrett <matthew.garrett@xxxxxxxxxx> > Signed-off-by: David Howells <dhowells@xxxxxxxxxx> > Acked-by: Dave Young <dyoung@xxxxxxxxxx> > cc: kexec@xxxxxxxxxxxxxxxxxxx Reviewed-by: James Morris <james.l.morris@xxxxxxxxxx> -- James Morris <james.l.morris@xxxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
