mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-01-26 19:29:37 +07:00
99d5cadfde
This is a preparatory patch for kexec_file_load() lockdown. A locked down kernel needs to prevent unsigned kernel images from being loaded with kexec_file_load(). Currently, the only way to force the signature verification is compiling with KEXEC_VERIFY_SIG. This prevents loading usigned images even when the kernel is not locked down at runtime. This patch splits KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE. Analogous to the MODULE_SIG and MODULE_SIG_FORCE for modules, KEXEC_SIG turns on the signature verification but allows unsigned images to be loaded. KEXEC_SIG_FORCE disallows images without a valid signature. Signed-off-by: Jiri Bohac <jbohac@suse.cz> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Matthew Garrett <mjg59@google.com> cc: kexec@lists.infradead.org Signed-off-by: James Morris <jmorris@namei.org> |
||
|---|---|---|
| .. | ||
| asym_tpm.c | ||
| asymmetric_keys.h | ||
| asymmetric_type.c | ||
| Kconfig | ||
| Makefile | ||
| mscode_parser.c | ||
| mscode.asn1 | ||
| pkcs7_key_type.c | ||
| pkcs7_parser.c | ||
| pkcs7_parser.h | ||
| pkcs7_trust.c | ||
| pkcs7_verify.c | ||
| pkcs7.asn1 | ||
| pkcs8_parser.c | ||
| pkcs8.asn1 | ||
| public_key.c | ||
| restrict.c | ||
| signature.c | ||
| tpm_parser.c | ||
| tpm.asn1 | ||
| verify_pefile.c | ||
| verify_pefile.h | ||
| x509_akid.asn1 | ||
| x509_cert_parser.c | ||
| x509_parser.h | ||
| x509_public_key.c | ||
| x509.asn1 | ||