From: "Thomas Weißschuh" <linux@weissschuh.net>
To: Masahiro Yamada <masahiroy@kernel.org>,
Nathan Chancellor <nathan@kernel.org>,
Nicolas Schier <nicolas@fjasle.eu>,
Arnd Bergmann <arnd@arndb.de>,
Luis Chamberlain <mcgrof@kernel.org>,
Petr Pavlu <petr.pavlu@suse.com>,
Sami Tolvanen <samitolvanen@google.com>,
Daniel Gomez <da.gomez@samsung.com>,
Paul Moore <paul@paul-moore.com>,
James Morris <jmorris@namei.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
Jonathan Corbet <corbet@lwn.net>
Cc: "Fabian Grünbichler" <f.gruenbichler@proxmox.com>,
"Arnout Engelen" <arnout@bzzt.net>,
"Mattia Rizzolo" <mattia@mapreri.org>,
kpcyrd <kpcyrd@archlinux.org>,
linux-kbuild@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-arch@vger.kernel.org, linux-modules@vger.kernel.org,
linux-security-module@vger.kernel.org, linux-doc@vger.kernel.org,
"Thomas Weißschuh" <linux@weissschuh.net>
Subject: [PATCH v2 5/6] lockdown: Make the relationship to MODULE_SIG a dependency
Date: Mon, 20 Jan 2025 18:44:24 +0100 [thread overview]
Message-ID: <20250120-module-hashes-v2-5-ba1184e27b7f@weissschuh.net> (raw)
In-Reply-To: <20250120-module-hashes-v2-0-ba1184e27b7f@weissschuh.net>
The new hash-based module integrity checking will also be able to
satisfy the requirements of lockdown.
Such an alternative is not representable with "select", so use
"depends on" instead.
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
---
security/lockdown/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig
index e84ddf48401010bcc0829a32db58e6f12bfdedcb..155959205b8eac2c85897a8c4c8b7ec471156706 100644
--- a/security/lockdown/Kconfig
+++ b/security/lockdown/Kconfig
@@ -1,7 +1,7 @@
config SECURITY_LOCKDOWN_LSM
bool "Basic module for enforcing kernel lockdown"
depends on SECURITY
- select MODULE_SIG if MODULES
+ depends on !MODULES || MODULE_SIG
help
Build support for an LSM that enforces a coarse kernel lockdown
behaviour.
--
2.48.1
next prev parent reply other threads:[~2025-01-20 17:45 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-01-20 17:44 [PATCH v2 0/6] module: Introduce hash-based integrity checking Thomas Weißschuh
2025-01-20 17:44 ` [PATCH v2 1/6] kbuild: add stamp file for vmlinux BTF data Thomas Weißschuh
2025-01-20 17:44 ` [PATCH v2 2/6] module: Make module loading policy usable without MODULE_SIG Thomas Weißschuh
2025-01-20 17:44 ` [PATCH v2 3/6] module: Move integrity checks into dedicated function Thomas Weißschuh
2025-01-20 17:44 ` [PATCH v2 4/6] module: Move lockdown check into generic module loader Thomas Weißschuh
2025-01-20 17:44 ` Thomas Weißschuh [this message]
2025-01-20 17:44 ` [PATCH v2 6/6] module: Introduce hash-based integrity checking Thomas Weißschuh
2025-01-22 23:28 ` kpcyrd
2025-03-06 8:10 ` Thomas Weißschuh
2025-02-03 14:22 ` Petr Pavlu
2025-02-04 21:22 ` Thomas Weißschuh
2025-01-21 10:26 ` [PATCH v2 0/6] " Roberto Sassu
2025-01-21 12:58 ` Thomas Weißschuh
2025-01-21 13:11 ` Roberto Sassu
2025-01-25 21:16 ` Câju Mihai-Drosi
2025-02-03 13:14 ` Christian Heusel
2025-02-04 21:08 ` Thomas Weißschuh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250120-module-hashes-v2-5-ba1184e27b7f@weissschuh.net \
--to=linux@weissschuh.net \
--cc=arnd@arndb.de \
--cc=arnout@bzzt.net \
--cc=corbet@lwn.net \
--cc=da.gomez@samsung.com \
--cc=f.gruenbichler@proxmox.com \
--cc=jmorris@namei.org \
--cc=kpcyrd@archlinux.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kbuild@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-modules@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=masahiroy@kernel.org \
--cc=mattia@mapreri.org \
--cc=mcgrof@kernel.org \
--cc=nathan@kernel.org \
--cc=nicolas@fjasle.eu \
--cc=paul@paul-moore.com \
--cc=petr.pavlu@suse.com \
--cc=samitolvanen@google.com \
--cc=serge@hallyn.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®