The kexec_load() syscall permits the loading and execution of arbitrary code in ring 0, which is something that lock-down is meant to prevent. It makes sense to disable kexec_load() in this situation. This does not affect kexec_file_load() syscall which can check for a signature on the image to be booted.
Showing the changes to include/linux (1 of 3 files). Show all
Unified · Split
| @@ -105,6 +105,7 @@ enum lockdown_reason { · 104 unmodified lines | |||
| 105 | LOCKDOWN_NONE, | 105 | LOCKDOWN_NONE, |
| 106 | LOCKDOWN_MODULE_SIGNATURE, | 106 | LOCKDOWN_MODULE_SIGNATURE, |
| 107 | LOCKDOWN_DEV_MEM, | 107 | LOCKDOWN_DEV_MEM, |
| 108 | LOCKDOWN_KEXEC, | ||
| 108 | LOCKDOWN_INTEGRITY_MAX, | 109 | LOCKDOWN_INTEGRITY_MAX, |
| 109 | LOCKDOWN_CONFIDENTIALITY_MAX, | 110 | LOCKDOWN_CONFIDENTIALITY_MAX, |
| 110 | }; | 111 | }; |