Skip to content
Permalink
Browse files Browse the repository at this point in the history
kexec/uefi: copy secure_boot flag in boot params across kexec reboot
Kexec reboot in case secure boot being enabled does not keep the secure
boot mode in new kernel, so later one can load unsigned kernel via legacy
kexec_load.  In this state, the system is missing the protections provided
by secure boot. Adding a patch to fix this by retain the secure_boot flag
in original kernel.

secure_boot flag in boot_params is set in EFI stub, but kexec bypasses the
stub. Fixing this issue by copying secure_boot flag across kexec reboot.

Signed-off-by: Dave Young <dyoung@redhat.com>
  • Loading branch information
daveyoung authored and Matthew Garrett committed Apr 3, 2016
1 parent 500a872 commit 4b2b64d
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions arch/x86/kernel/kexec-bzimage64.c
Expand Up @@ -180,6 +180,7 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,
if (efi_enabled(EFI_OLD_MEMMAP))
return 0;

params->secure_boot = boot_params.secure_boot;
ei->efi_loader_signature = current_ei->efi_loader_signature;
ei->efi_systab = current_ei->efi_systab;
ei->efi_systab_hi = current_ei->efi_systab_hi;
Expand Down

0 comments on commit 4b2b64d

Please sign in to comment.