[lkml]   [2018]   [Mar]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH v2 0/4] modsign enhancement
+++ Jia Zhang [08/03/18 12:26 +0800]:
>This patch series allows to disable module validity enforcement
>in runtime through /sys/kernel/security/modsign/enforce interface.
>Assuming CONFIG_MODULE_SIG_FORCE=y, here are the instructions to
>disable the validity enforcement.
># cat /sys/kernel/security/modsign/enforce
># echo -n 0 > data
># openssl smime -sign -nocerts -noattr -binary -in data \
> -inkey <system_trusted_key> -signer <cert> -outform der \
> -out /sys/kernel/security/modsign/enforce
>Now enable enforcement again on demand.
># echo 1 > /sys/kernel/security/modsign/enforce
>- Support to disable validity enforcement in runtime.

NAK - please use /sys/module/module/parameters/sig_enforce.

And I would rather keep this parameter bool_enable_only, plain and simple.
What use case do you have/why would you want to disable signature
enforcement - after having enabled it - during runtime? None of this
is explained nor justified in the cover letter.



 \ /
  Last update: 2018-03-12 14:29    [W:0.102 / U:28.724 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site