Re: [PATCH 00/12] One more attempt at useful kernel lockdown

[Matthew Garrett]

On Mon, 2013-09-09 at 11:25 -0700, David Lang wrote:

> Given that we know that people want signed binaries without blocking kexec, you 
> should have '1' just enforce module signing and '2' (or higher) implement a full 
> lockdown including kexec.

There's already a kernel option for that.
-- 
Matthew Garrett <matthew.garrett@xxxxxxxxxx>
¢éì®&Þ~º&¶¬–+-±éÝ¥Šw®žË±Êâmébžìdz¹Þ)í…æèw*jg¬±¨¶‰šŽŠÝj/êäz¹ÞŠà2ŠÞ¨è­Ú&¢)ß«a¶Úþø®G«éh®æj:+v‰¨Šwè†Ù>Wš±êÞiÛaxPjØm¶ŸÿÃ-»+ƒùdš_