Messages in this thread Patch in this message | | | From | Matthew Garrett <> | Date | Fri, 13 Mar 2015 11:38:18 -1000 | Subject | [PATCH 02/12] Enforce module signatures when trusted kernel is enabled |
| |
If trusted_kernel is true, require that all modules have valid signatures.
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com> --- include/linux/module.h | 6 ++++++ kernel/module.c | 6 ++++++ security/trusted_kernel.c | 6 +++++- 3 files changed, 17 insertions(+), 1 deletion(-)
diff --git a/include/linux/module.h b/include/linux/module.h index 42999fe..1cf89e2 100644 --- a/include/linux/module.h +++ b/include/linux/module.h @@ -502,6 +502,8 @@ int unregister_module_notifier(struct notifier_block *nb); extern void print_modules(void); +void enable_module_sig_enforce(void); + #else /* !CONFIG_MODULES... */ /* Given an address, look for it in the exception tables. */ @@ -612,6 +614,10 @@ static inline int unregister_module_notifier(struct notifier_block *nb) static inline void print_modules(void) { } + +static inline void enable_module_sig_enforce(void) +{ +} #endif /* CONFIG_MODULES */ #ifdef CONFIG_SYSFS diff --git a/kernel/module.c b/kernel/module.c index cc93cf6..842f58e 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -3893,3 +3893,9 @@ void module_layout(struct module *mod, } EXPORT_SYMBOL(module_layout); #endif + +void enable_module_sig_enforce(void) +{ + sig_enforce = true; +} +EXPORT_SYMBOL(enable_module_sig_enforce); diff --git a/security/trusted_kernel.c b/security/trusted_kernel.c index 2808113..22c4c30 100644 --- a/security/trusted_kernel.c +++ b/security/trusted_kernel.c @@ -11,6 +11,7 @@ #include <linux/fs.h> #include <linux/init.h> +#include <linux/module.h> #include <linux/security.h> #include <linux/uaccess.h> @@ -29,6 +30,9 @@ int set_trusted_kernel(bool new_trusted_kernel) trusted_kernel = new_trusted_kernel; + if (trusted_kernel == true) + enable_module_sig_enforce(); + return 0; } EXPORT_SYMBOL(set_trusted_kernel); @@ -105,7 +109,7 @@ late_initcall(setup_trusted_kernel); static int __init enable_trusted_kernel(char *__str) { - trusted_kernel = true; + set_trusted_kernel(true); return 1; } __setup("trusted_kernel", enable_trusted_kernel); -- 2.1.0
| |