f (!file && read_id == READING_MODULE) /* MODULE_SIG_FORCE enabled */
> + /*
> + * If both IMA-appraisal and appended signature verification are
> + * enabled, rely on the appended signature verification.
> + */
> + if (sig_enforce && read_id == READING_MODULE)
> return 0;
>
> /* permit signed certs */
> --
> 2.7.5
>
I agree with the solution.
Acked-by: Bruno E. O. Meneguele
signature.asc
Description: PGP signature
Ignore this erroneously sent email.
v2 was already superseded by v3.
On 05-12, Bruno E. O. Meneguele wrote:
> Simple but useful message log to the user in case of module appraise is
> forced and fails due to the lack of file descriptor, that might be
> caused by kmod calls to compresse
Simple but useful message log to the user in case of module appraise is
forced and fails due to the lack of file descriptor, that might be
caused by kmod calls to compressed modules.
Signed-off-by: Bruno E. O. Meneguele
---
security/integrity/ima/ima_main.c | 6 +-
1 file changed, 5
From: "Bruno E. O. Meneguele"
Simple but useful message log to the user in case of module appraise is
forced and fails due to the lack of file descriptor, that might be
caused by kmod calls to compressed modules.
Signed-off-by: Bruno E. O. Meneguele
---
security/integrity/ima/ima_
On 04-12, Joe Perches wrote:
> On Mon, 2017-12-04 at 18:23 -0200, Bruno E. O. Meneguele wrote:
> > Simple but useful message log to the user in case of module appraise is
> > forced and fails due to the lack of file descriptor, that might be
> > caused by kmod calls
Simple but useful message log to the user in case of module appraise is
forced and fails due to the lack of file descriptor, that might be
caused by kmod calls to compressed modules.
Signed-off-by: Bruno E. O. Meneguele
---
security/integrity/ima/ima_main.c | 6 +-
1 file changed, 5
On 04-12, Bruno E. O. Meneguele wrote:
> Simple but useful message log to the user in case of module appraise is
> forced and fails due to the lack of file descriptor, that might be
> caused by kmod calls to compressed modules.
>
> Signed-off-by: Bruno E. O. Meneguele
> ---
Simple but useful message log to the user in case of module appraise is
forced and fails due to the lack of file descriptor, that might be
caused by kmod calls to compressed modules.
Signed-off-by: Bruno E. O. Meneguele
---
security/integrity/ima/ima_main.c | 6 +-
1 file changed, 5
On 25-10, Mimi Zohar wrote:
> On Wed, 2017-10-25 at 13:05 -0200, Bruno E. O. Meneguele wrote:
> > On 24-10, Mimi Zohar wrote:
> > > On Tue, 2017-10-24 at 15:37 -0200, Bruno E. O. Meneguele wrote:
> > > > When the user requests MODULE_CHECK policy and its k
On 24-10, Mimi Zohar wrote:
> On Tue, 2017-10-24 at 15:37 -0200, Bruno E. O. Meneguele wrote:
> > When the user requests MODULE_CHECK policy and its kernel is compiled
> > with CONFIG_MODULE_SIG_FORCE not set, all modules would not load, just
> > those loaded in initram time
1/2 - code changes to correct checkpatch.pl warnings.
Bruno E. O. Meneguele (2):
module: export module signature enforcement status
ima: check signature enforcement against cmdline param instead of
CONFIG
include/linux/module.h| 7 +++
kernel/module.c
doesn't rely on this value, it checks just
CONFIG_MODULE_SIG_FORCE.
This patch solves this problem checking for the exported value of
module.sig_enforce cmdline param intead of CONFIG_MODULE_SIG_FORCE,
which holds the effective value (CONFIG || param).
Signed-off-by: Bruno E. O. Mene
ctive value of
module signature enforcement, being it from CONFIG value or cmdline
param.
Signed-off-by: Bruno E. O. Meneguele
---
include/linux/module.h | 7 +++
kernel/module.c| 10 ++
2 files changed, 17 insertions(+)
diff --git a/include/linux/module.h b/include/linux/mod
ctive value of
module signature enforcement, being it from CONFIG value or cmdline
param.
Signed-off-by: Bruno E. O. Meneguele
---
include/linux/module.h | 2 ++
kernel/module.c| 10 ++
2 files changed, 12 insertions(+)
diff --git a/include/linux/module.h b/include/linux/module.h
doesn't rely on this value, it checks just
CONFIG_MODULE_SIG_FORCE.
This patch solves this problem checking for the exported value of
module.sig_enforce cmdline param intead of CONFIG_MODULE_SIG_FORCE,
which holds the effective value (CONFIG || param).
Signed-off-by: Bruno E. O. Mene
le(0x7f9602d6e010, 386646, "") = 0
The patchset was tested in two different kernels: 4.13.6 (Fedora 27) and
4.14.0-rc4 (integrity-next tree)
Bruno E. O. Meneguele (2):
module: export module signature enforcement status
ima: check signature enforcement against cmdline param instead of
On 23-10, Mimi Zohar wrote:
> On Fri, 2017-10-20 at 17:19 -0200, Bruno E. O. Meneguele wrote:
> > A static variable sig_enforce is used as status var to indicate the real
> > value of CONFIG_MODULE_SIG_FORCE, once this one is set the var will hold
> > true, but if the CONFIG
ctive value of
module signature enforcement, being it from CONFIG value or cmdline
param.
Signed-off-by: Bruno E. O. Meneguele
---
include/linux/module.h | 2 ++
kernel/module.c| 8
2 files changed, 10 insertions(+)
diff --git a/include/linux/module.h b/include/linux/module.h
doesn't rely on this value, it checks just
CONFIG_MODULE_SIG_FORCE.
This patch solves this problem checking for the exported value of
module.sig_enforce cmdline param intead of CONFIG_MODULE_SIG_FORCE,
which holds the effective value (CONFIG || param).
Signed-off-by: Bruno E. O. Mene
le(0x7f9602d6e010, 386646, "") = 0
The patchset was tested in two different kernels: 4.13.6 (Fedora 27) and
4.14.0-rc4 (integrity-next tree)
Bruno E. O. Meneguele (2):
module: export module signature enforcement status
ima: check signature enforcement against cmdline param instead of
Trivial typo correction on kernel/sched/topology.c pr_err() message.
Signed-off-by: Bruno E. O. Meneguele
---
kernel/sched/topology.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index bd8b6d6f5387..f87de3259b95 100644
Fixed some coding style issues.
Signed-off-by: Bruno E O Meneguele
---
drivers/char/tpm/tpm.h | 10 +-
drivers/char/tpm/tpm_i2c_stm_st33.c | 10 ++
2 files changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index
22 matches
Mail list logo
