Messages in this thread | | | Date | Thu, 8 Aug 2019 12:01:00 +0200 | From | Jessica Yu <> | Subject | Re: [PATCH V37 04/29] Enforce module signatures if the kernel is locked down |
| |
+++ Matthew Garrett [01/08/19 13:42 -0700]: >On Thu, Aug 1, 2019 at 7:22 AM Jessica Yu <jeyu@kernel.org> wrote: >> Apologies if this was addressed in another patch in your series (I've >> only skimmed the first few), but what should happen if the kernel is >> locked down, but CONFIG_MODULE_SIG=n? Or shouldn't CONFIG_SECURITY_LOCKDOWN_LSM >> depend on CONFIG_MODULE_SIG? Otherwise I think we'll end up calling >> the empty !CONFIG_MODULE_SIG module_sig_check() stub even though >> lockdown is enabled. > >Hm. Someone could certainly configure their kernel in that way. I'm >not sure that tying CONFIG_SECURITY_LOCKDOWN_LSM to CONFIG_MODULE_SIG >is the right solution, since the new LSM approach means that any other >LSM could also impose the same policy. Perhaps we should just document >this?
Hi Matthew,
If you're confident that a hard dependency is not the right approach, then perhaps we could add a comment in the Kconfig (You could take a look at the comment under MODULE_SIG_ALL in init/Kconfig for an example)? If someone is configuring the kernel on their own then it'd be nice to let them know, otherwise having a lockdown kernel without module signatures would defeat the purpose of lockdown no? :-)
Thank you,
Jessica
| |