Messages in this thread Patch in this message | | | From | Tianjia Zhang <> | Subject | [PATCH] module: Allow to disable modsign in kernel cmdline | Date | Tue, 28 Apr 2020 11:43:10 +0800 |
| |
This change allows to disable modsign completely at the beginning, and turn off by set the kernel cmdline `no_modsig_enforce` when CONFIG_MODULE_SIG_FORCE is enabled.
Yet another change allows to always show the current status of modsign through `/sys/module/module/parameters/sig_enforce`.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com> Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com> --- kernel/module.c | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/kernel/module.c b/kernel/module.c index 646f1e2330d2..0e68e1286377 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -269,6 +269,14 @@ static void module_assert_mutex_or_preempt(void) static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE); module_param(sig_enforce, bool_enable_only, 0644); +#ifdef CONFIG_MODULE_SIG_FORCE +static int __init set_no_modsig_enforce(char *str) +{ + sig_enforce = false; + return 1; +} +__setup("no_modsig_enforce", set_no_modsig_enforce); +#endif /* !CONFIG_MODULE_SIG_FORCE */ /* * Export sig_enforce kernel cmdline parameter to allow other subsystems rely -- 2.17.1
| |