Commit 06dcb013 authored by Ricardo Ribalda's avatar Ricardo Ribalda Committed by Andrew Morton

Documentation: sysctl: correct kexec_load_disabled

Patch series "kexec: Add new parameter to limit the access to kexec", v6.

Add two parameter to specify how many times a kexec kernel can be loaded.

These parameter allow hardening the system.

While we are at it, fix a documentation issue and refactor some code.


This patch (of 3):

kexec_load_disabled affects both ``kexec_load`` and ``kexec_file_load``
syscalls. Make it explicit.

Link: https://lkml.kernel.org/r/20221114-disable-kexec-reset-v6-0-6a8531a09b9a@chromium.org
Link: https://lkml.kernel.org/r/20221114-disable-kexec-reset-v6-1-6a8531a09b9a@chromium.orgSigned-off-by: default avatarRicardo Ribalda <ribalda@chromium.org>
Reviewed-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
Acked-by: default avatarBaoquan He <bhe@redhat.com>
Cc: Bagas Sanjaya <bagasdotme@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Guilherme G. Piccoli <gpiccoli@igalia.com>
Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Philipp Rudo <prudo@redhat.com>
Cc: Ross Zwisler <zwisler@kernel.org>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 227849a3
...@@ -453,9 +453,10 @@ this allows system administrators to override the ...@@ -453,9 +453,10 @@ this allows system administrators to override the
kexec_load_disabled kexec_load_disabled
=================== ===================
A toggle indicating if the ``kexec_load`` syscall has been disabled. A toggle indicating if the syscalls ``kexec_load`` and
This value defaults to 0 (false: ``kexec_load`` enabled), but can be ``kexec_file_load`` have been disabled.
set to 1 (true: ``kexec_load`` disabled). This value defaults to 0 (false: ``kexec_*load`` enabled), but can be
set to 1 (true: ``kexec_*load`` disabled).
Once true, kexec can no longer be used, and the toggle cannot be set Once true, kexec can no longer be used, and the toggle cannot be set
back to false. back to false.
This allows a kexec image to be loaded before disabling the syscall, This allows a kexec image to be loaded before disabling the syscall,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment