lkml.org 
[lkml]   [2013]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 02/12] Enforce module signatures when securelevel is greater than 0
    Date
    If securelevel has been set to 1 or greater, require that all modules have
    valid signatures.

    Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
    ---
    kernel/module.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/kernel/module.c b/kernel/module.c
    index dc58274..ab126d7 100644
    --- a/kernel/module.c
    +++ b/kernel/module.c
    @@ -2487,7 +2487,7 @@ static int module_sig_check(struct load_info *info)
    if (err < 0 && fips_enabled)
    panic("Module verification failed with error %d in FIPS mode\n",
    err);
    - if (err == -ENOKEY && !sig_enforce)
    + if ((err == -ENOKEY && !sig_enforce) && (get_securelevel() <= 0))
    err = 0;

    return err;
    --
    1.8.3.1


    \
     
     \ /
      Last update: 2013-09-10 00:21    [W:4.542 / U:1.188 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site