Re: [RFC] Second attempt at kernel secure boot support

[Chris Friesen]

On 11/02/2012 09:48 AM, Vivek Goyal wrote:
> On Thu, Nov 01, 2012 at 03:02:25PM -0600, Chris Friesen wrote:

> > With secure boot enabled, then the kernel should refuse to let an
> > unsigned kexec load new images, and kexec itself should refuse to
> > load unsigned images.
>
> Yep, good in theory. Now that basically means reimplementing kexec-tools
> in kernel.

Maybe I'm missing something, but couldn't the vendors provide a signed 
kexec?  Why does extra stuff need to be pushed into the kernel?

Chris
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/