Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 03/27] Enforce module signatures if the kernel is locked down | Date | Thu, 02 Nov 2017 21:30:11 +0000 |
| |
Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> By this point, IMA-appraisal has already verified the kernel module > signature back in kernel_read_file_from_fd(), if it was required. > Having a key with which to verify the appended signature or requiring > an appended signature, should not be required as well.
I guess I don't need to put in any support for IMA here, then, and you've taken care of it in your patchset such that it won't actually go into module_sig_check() in that case (or will at least return immediately).
David
| |