Re: [PATCH 4/6] kexec: A new system call, kexec_file_load, for inkernel kexec

From: H. Peter Anvin
Date: Mon Jan 06 2014 - 23:23:46 EST

On 01/06/2014 01:33 PM, Josh Boyer wrote:
> On Thu, Jan 2, 2014 at 3:56 PM, H. Peter Anvin <hpa@xxxxxxxxx> wrote:
>> On 01/02/2014 12:39 PM, Vivek Goyal wrote:
>>> If secureboot is enabled, it enforces module signature verification. I
>>> think similar will happen for kexec too. How would kernel know that on
>>> a secureboot platform fd original verification will happen and it is
>>> sufficient.
>>> I personally want to support bzImage as well (apart from ELF) because
>>> distributions has been shipping bzImage for a long time and I don't
>>> want to enforce a change there because of secureboot. It is not necessary.
>>> Right now I am thinking more about storing detached bzImage signatures
>>> and passing those signatures to kexec system call.
>> Since the secureboot scenario probably means people will be signing
>> those kernels, and those kernels are going to be EFI images, that in
>> order to have "one kernel, one signature" there will be a desire to
>> support signed PE images. Yes, PE is ugly but it shouldn't be too bad.
>> However, it is probably one of those things that can be dealt with one
>> bit at a time.
> David Howells posted patches to support signed PE binaries early last
> year. They were rejected rather quickly.
> That was for loading keys via PE binaries, but the parser is needed
> either way. Unless I'm misunderstanding what you're suggesting?

I know. I think the kexec is a better motivation, though.


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at