[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Xen-devel] [PATCH v3 00/11] xen: Initial kexec/kdump implementation
- To: Vivek Goyal <vgoyal@xxxxxxxxxx>
- From: "H. Peter Anvin" <hpa@xxxxxxxxx>
- Date: Fri, 11 Jan 2013 13:14:46 -0800
- Cc: "xen-devel@xxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxx>, Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Daniel Kiper <daniel.kiper@xxxxxxxxxx>, "x86@xxxxxxxxxx" <x86@xxxxxxxxxx>, "kexec@xxxxxxxxxxxxxxxxxxx" <kexec@xxxxxxxxxxxxxxxxxxx>, "linux-kernel@xxxxxxxxxxxxxxx" <linux-kernel@xxxxxxxxxxxxxxx>, "virtualization@xxxxxxxxxxxxxxxxxxxxxxxxxx" <virtualization@xxxxxxxxxxxxxxxxxxxxxxxxxx>, David Howells <dhowells@xxxxxxxxxx>, "mingo@xxxxxxxxxx" <mingo@xxxxxxxxxx>, "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>, Jan Beulich <JBeulich@xxxxxxxx>, "maxim.uvarov@xxxxxxxxxx" <maxim.uvarov@xxxxxxxxxx>, "tglx@xxxxxxxxxxxxx" <tglx@xxxxxxxxxxxxx>
- Delivery-date: Fri, 11 Jan 2013 21:15:27 +0000
- List-id: Xen developer discussion <xen-devel.lists.xen.org>
On 01/11/2013 01:08 PM, Vivek Goyal wrote:
A signed /sbin/kexec would realistically have to be statically linked,
at least in the short term; otherwise the libraries and ld.so would need
verification as well.
Yes. That's the expectation. Sign only statically linked exeutables which
don't do any of dlopen() stuff either.
In fact in the patch, I fail the exec() if signed executable has
interpreter.
As I said, though (and possibly not for kexec, that depends): in the
long term we probably want a way to be able to sign all kinds binaries
in the system.
-hpa
--
H. Peter Anvin, Intel Open Source Technology Center
I work for Intel. I don't speak on their behalf.
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel
|
