Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 03/27] Enforce module signatures if the kernel is locked down | Date | Thu, 02 Nov 2017 22:01:07 +0000 |
| |
Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> Right, it would never get here if the IMA signature verification > fails. If sig_enforce is not enabled, then it will also work. So the > only case is if sig_enforced is enabled and there is no key. > > eg. > else if (can_do_ima_check && is_ima_appraise_enabled()) > err = 0;
I'm not sure where you want to put that, but I can't just do this:
/* Not having a signature is only an error if we're strict. */ if (err == -ENOKEY && !sig_enforce && (!can_do_ima_check || !is_ima_appraise_enabled()) && !kernel_is_locked_down("Loading of unsigned modules")) err = 0; else if (can_do_ima_check && is_ima_appraise_enabled()) err = 0;
because that'll print out a message in lockdown mode saying that you're not allowed to do that and then maybe do it anyway.
David
| |