On secure boot enabled systems with static keys, kexec using kexec_file_load(-s)
fails with the error "Permission Denied" when fadump is enabled.
Similar to kdump, load kernel signing key for fadump as well.
Reported-by: Sachin P Bappalige <sachinpb(a)linux.vnet.ibm.com>
Signed-off-by: Nayna Jain <nayna(a)linux.ibm.com>
---
kdumpctl | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/kdumpctl b/kdumpctl
index 9671410..54d21c7 100755
--- a/kdumpctl
+++ b/kdumpctl
@@ -978,6 +978,13 @@ start_fadump()
return 1
fi
+ # On secure boot enabled systems, load kernel signing key on .ima for signature
+ # verification using kexec file based syscall.
+ if is_secure_boot_enforced; then
+ dinfo "Secure Boot is enabled. Using kexec file based syscall."
+ load_kdump_kernel_key
+ fi
+
dinfo "fadump: registered successfully"
return 0
}
--
2.41.0