The kexec_load() syscall permits the loading and execution of arbitrary code in ring 0, which is something that lock-down is meant to prevent. It makes sense to disable kexec_load() in this situation. This does not affect kexec_file_load() syscall which can check for a signature on the image to be booted.
Showing the changes to include/linux (1 of 3 files). Show all
Unified · Split
| @@ -105,6 +105,7 @@ enum lockdown_reason { · 104 unmodified lines | ||
| 105 | 105 | LOCKDOWN_NONE, |
| 106 | 106 | LOCKDOWN_MODULE_SIGNATURE, |
| 107 | 107 | LOCKDOWN_DEV_MEM, |
| 108 | + LOCKDOWN_KEXEC, | |
| 108 | 109 | LOCKDOWN_INTEGRITY_MAX, |
| 109 | 110 | LOCKDOWN_CONFIDENTIALITY_MAX, |
| 110 | 111 | }; |