From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757225AbbCMVj3 (ORCPT ); Fri, 13 Mar 2015 17:39:29 -0400 Received: from cavan.codon.org.uk ([93.93.128.6]:60913 "EHLO cavan.codon.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757175AbbCMVjV (ORCPT ); Fri, 13 Mar 2015 17:39:21 -0400 From: Matthew Garrett To: linux-security-module@vger.kernel.org Cc: james.l.morris@oracle.com, serge@hallyn.com, linux-kernel@vger.kernel.org, keescook@chromium.org, hpa@zytor.com, gnomes@lxorguk.ukuu.org.uk, Matthew Garrett Date: Fri, 13 Mar 2015 11:38:18 -1000 Message-Id: <1426282708-21485-3-git-send-email-matthew.garrett@nebula.com> X-Mailer: git-send-email 2.1.0 In-Reply-To: <1426282708-21485-1-git-send-email-matthew.garrett@nebula.com> References: <1426282708-21485-1-git-send-email-matthew.garrett@nebula.com> X-SA-Do-Not-Run: Yes X-SA-Exim-Connect-IP: 72.253.89.114 X-SA-Exim-Mail-From: matthew.garrett@nebula.com X-Spam-ASN: Subject: [PATCH 02/12] Enforce module signatures when trusted kernel is enabled X-SA-Exim-Version: 4.2.1 (built Mon, 26 Dec 2011 16:54:46 +0000) X-SA-Exim-Scanned: Yes (on cavan.codon.org.uk) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If trusted_kernel is true, require that all modules have valid signatures. Signed-off-by: Matthew Garrett --- include/linux/module.h | 6 ++++++ kernel/module.c | 6 ++++++ security/trusted_kernel.c | 6 +++++- 3 files changed, 17 insertions(+), 1 deletion(-) diff --git a/include/linux/module.h b/include/linux/module.h index 42999fe..1cf89e2 100644 --- a/include/linux/module.h +++ b/include/linux/module.h @@ -502,6 +502,8 @@ int unregister_module_notifier(struct notifier_block *nb); extern void print_modules(void); +void enable_module_sig_enforce(void); + #else /* !CONFIG_MODULES... */ /* Given an address, look for it in the exception tables. */ @@ -612,6 +614,10 @@ static inline int unregister_module_notifier(struct notifier_block *nb) static inline void print_modules(void) { } + +static inline void enable_module_sig_enforce(void) +{ +} #endif /* CONFIG_MODULES */ #ifdef CONFIG_SYSFS diff --git a/kernel/module.c b/kernel/module.c index cc93cf6..842f58e 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -3893,3 +3893,9 @@ void module_layout(struct module *mod, } EXPORT_SYMBOL(module_layout); #endif + +void enable_module_sig_enforce(void) +{ + sig_enforce = true; +} +EXPORT_SYMBOL(enable_module_sig_enforce); diff --git a/security/trusted_kernel.c b/security/trusted_kernel.c index 2808113..22c4c30 100644 --- a/security/trusted_kernel.c +++ b/security/trusted_kernel.c @@ -11,6 +11,7 @@ #include #include +#include #include #include @@ -29,6 +30,9 @@ int set_trusted_kernel(bool new_trusted_kernel) trusted_kernel = new_trusted_kernel; + if (trusted_kernel == true) + enable_module_sig_enforce(); + return 0; } EXPORT_SYMBOL(set_trusted_kernel); @@ -105,7 +109,7 @@ late_initcall(setup_trusted_kernel); static int __init enable_trusted_kernel(char *__str) { - trusted_kernel = true; + set_trusted_kernel(true); return 1; } __setup("trusted_kernel", enable_trusted_kernel); -- 2.1.0