diff options
| author | David Howells <dhowells@redhat.com> | 2019-08-20 02:17:40 +0200 |
|---|---|---|
| committer | James Morris <jmorris@namei.org> | 2019-08-20 06:54:15 +0200 |
| commit | 49fcf732bdae0550721ef73af7c45109ce26b2a9 (patch) | |
| tree | cdf90d95cc5fb01413ac3c83f51796c1c3a0cdec /init | |
| parent | security: Add a static lockdown policy LSM (diff) | |
| download | linux-49fcf732bdae0550721ef73af7c45109ce26b2a9.tar.xz linux-49fcf732bdae0550721ef73af7c45109ce26b2a9.zip | |
lockdown: Enforce module signatures if the kernel is locked down
If the kernel is locked down, require that all modules have valid
signatures that we can verify.
I have adjusted the errors generated:
(1) If there's no signature (ENODATA) or we can't check it (ENOPKG,
ENOKEY), then:
(a) If signatures are enforced then EKEYREJECTED is returned.
(b) If there's no signature or we can't check it, but the kernel is
locked down then EPERM is returned (this is then consistent with
other lockdown cases).
(2) If the signature is unparseable (EBADMSG, EINVAL), the signature fails
the check (EKEYREJECTED) or a system error occurs (eg. ENOMEM), we
return the error we got.
Note that the X.509 code doesn't check for key expiry as the RTC might not
be valid or might not have been transferred to the kernel's clock yet.
[Modified by Matthew Garrett to remove the IMA integration. This will
be replaced with integration with the IMA architecture policy
patchset.]
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Matthew Garrett <matthewgarrett@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: Jessica Yu <jeyu@kernel.org>
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'init')
| -rw-r--r-- | init/Kconfig | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/init/Kconfig b/init/Kconfig index 0e2344389501..e6069368f278 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1939,6 +1939,11 @@ config MODULE_SIG kernel build dependency so that the signing tool can use its crypto library. + You should enable this option if you wish to use either + CONFIG_SECURITY_LOCKDOWN_LSM or lockdown functionality imposed via + another LSM - otherwise unsigned modules will be loadable regardless + of the lockdown policy. + !!!WARNING!!! If you enable this option, you MUST make sure that the module DOES NOT get stripped after being signed. This includes the debuginfo strip done by some packagers (such as rpmbuild) and |