* [PATCH] kexec: move KEXEC_SIG_FORCE from arch/x86 to arch
@ 2022-02-10 13:16 Michal Suchanek
2022-02-10 17:33 ` Kees Cook
0 siblings, 1 reply; 2+ messages in thread
From: Michal Suchanek @ 2022-02-10 13:16 UTC (permalink / raw)
To: kexec
Cc: Michal Suchanek, Thomas Gleixner, Ingo Molnar, Borislav Petkov,
Dave Hansen, x86, H. Peter Anvin, Kees Cook, Masahiro Yamada,
Nathan Chancellor, Peter Zijlstra (Intel),
Sami Tolvanen, Mark Rutland, Nicholas Piggin, Guenter Roeck,
Colin Ian King, linux-kernel
There is nothing x86-specific about KEXEC_SIG_FORCE
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
---
arch/Kconfig | 7 +++++++
arch/x86/Kconfig | 7 -------
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/arch/Kconfig b/arch/Kconfig
index 678a80713b21..dc2446f01ac1 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -24,6 +24,13 @@ config KEXEC_ELF
config HAVE_IMA_KEXEC
bool
+config KEXEC_SIG_FORCE
+ bool "Require a valid signature in kexec_file_load() syscall"
+ depends on KEXEC_SIG
+ help
+ This option makes kernel signature verification mandatory for
+ the kexec_file_load() syscall.
+
config SET_FS
bool
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 9f5bd41bf660..3ea648dad6b6 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2032,13 +2032,6 @@ config KEXEC_SIG
verification for the corresponding kernel image type being
loaded in order for this to work.
-config KEXEC_SIG_FORCE
- bool "Require a valid signature in kexec_file_load() syscall"
- depends on KEXEC_SIG
- help
- This option makes kernel signature verification mandatory for
- the kexec_file_load() syscall.
-
config KEXEC_BZIMAGE_VERIFY_SIG
bool "Enable bzImage signature verification support"
depends on KEXEC_SIG
--
2.31.1
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] kexec: move KEXEC_SIG_FORCE from arch/x86 to arch
2022-02-10 13:16 [PATCH] kexec: move KEXEC_SIG_FORCE from arch/x86 to arch Michal Suchanek
@ 2022-02-10 17:33 ` Kees Cook
0 siblings, 0 replies; 2+ messages in thread
From: Kees Cook @ 2022-02-10 17:33 UTC (permalink / raw)
To: Michal Suchanek
Cc: kexec, Thomas Gleixner, Ingo Molnar, Borislav Petkov,
Dave Hansen, x86, H. Peter Anvin, Masahiro Yamada,
Nathan Chancellor, Peter Zijlstra (Intel),
Sami Tolvanen, Mark Rutland, Nicholas Piggin, Guenter Roeck,
Colin Ian King, linux-kernel
On Thu, Feb 10, 2022 at 02:16:48PM +0100, Michal Suchanek wrote:
> There is nothing x86-specific about KEXEC_SIG_FORCE
>
> Signed-off-by: Michal Suchanek <msuchanek@suse.de>
> ---
> arch/Kconfig | 7 +++++++
> arch/x86/Kconfig | 7 -------
> 2 files changed, 7 insertions(+), 7 deletions(-)
>
> diff --git a/arch/Kconfig b/arch/Kconfig
> index 678a80713b21..dc2446f01ac1 100644
> --- a/arch/Kconfig
> +++ b/arch/Kconfig
> @@ -24,6 +24,13 @@ config KEXEC_ELF
> config HAVE_IMA_KEXEC
> bool
>
> +config KEXEC_SIG_FORCE
> + bool "Require a valid signature in kexec_file_load() syscall"
> + depends on KEXEC_SIG
> + help
> + This option makes kernel signature verification mandatory for
> + the kexec_file_load() syscall.
> +
> config SET_FS
> bool
>
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index 9f5bd41bf660..3ea648dad6b6 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -2032,13 +2032,6 @@ config KEXEC_SIG
> verification for the corresponding kernel image type being
> loaded in order for this to work.
>
> -config KEXEC_SIG_FORCE
> - bool "Require a valid signature in kexec_file_load() syscall"
> - depends on KEXEC_SIG
> - help
> - This option makes kernel signature verification mandatory for
> - the kexec_file_load() syscall.
> -
This means it is no longer folded under KEXEC_SIG in menuconfig,
which makes it harder to find. I would prefer seeing KEXEC_SIG (and
KEXEC_SIG_FORCE) moved out of the per-arch Kconfig files into a common
location, and then arch Kconfig can add something like:
select ARCH_SUPPORTS_KEXEC
> config KEXEC_BZIMAGE_VERIFY_SIG
> bool "Enable bzImage signature verification support"
> depends on KEXEC_SIG
> --
> 2.31.1
>
--
Kees Cook
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-02-10 17:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-10 13:16 [PATCH] kexec: move KEXEC_SIG_FORCE from arch/x86 to arch Michal Suchanek
2022-02-10 17:33 ` Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®