Currently kexec/kdump is not capable of making EFI run time calls in second kernel. Instead we disable EFI in second kernel and try hard not to make any BIOS calls. So do not try to import any keys/certs from db/mok.
This should change once we have figured out how to make EFI run time calls in second kernel. Signed-off-by: Vivek Goyal <[email protected]> --- kernel/modsign_uefi.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/modsign_uefi.c b/kernel/modsign_uefi.c index 94b0eb3..e7758eb 100644 --- a/kernel/modsign_uefi.c +++ b/kernel/modsign_uefi.c @@ -49,6 +49,15 @@ static int __init load_uefi_certs(void) unsigned long dbsize = 0, dbxsize = 0, moksize = 0; int rc = 0; + /* + * Don't load certs from uefi if we are not supposed to use EFI run + * time services. Currently in Kdump kernel one is not supposed to + * use run time serices. + */ + + if (!efi_enabled(EFI_RUNTIME_SERVICES)) + return 0; + /* Check if SB is enabled and just return if not */ if (!efi_enabled(EFI_SECURE_BOOT)) return 0; -- 1.8.3.1 _______________________________________________ kernel mailing list [email protected] https://admin.fedoraproject.org/mailman/listinfo/kernel
