Re: [PATCH] MODSIGN: Don't taint unless signature enforcing is enabled

2013-01-07 Thread Josh Boyer
On Mon, Jan 07, 2013 at 11:39:47AM +1030, Rusty Russell wrote: > Josh Boyer writes: > > With module signing enabled but not in enforcing mode, we don't consider > > unsigned modules to be an error. However, we only mark sig_ok as true if > > a signature verified. This causes the module to be

Re: [PATCH] MODSIGN: Don't taint unless signature enforcing is enabled

2013-01-07 Thread Josh Boyer
On Mon, Jan 07, 2013 at 11:39:47AM +1030, Rusty Russell wrote: Josh Boyer jwbo...@redhat.com writes: With module signing enabled but not in enforcing mode, we don't consider unsigned modules to be an error. However, we only mark sig_ok as true if a signature verified. This causes the

Re: [PATCH] MODSIGN: Don't taint unless signature enforcing is enabled

2013-01-06 Thread Rusty Russell
Josh Boyer writes: > With module signing enabled but not in enforcing mode, we don't consider > unsigned modules to be an error. However, we only mark sig_ok as true if > a signature verified. This causes the module to be tainted with the > TAINT_FORCED_MODULE flag. Wait, what? So, what does

Re: [PATCH] MODSIGN: Don't taint unless signature enforcing is enabled

2013-01-06 Thread Rusty Russell
Josh Boyer jwbo...@redhat.com writes: With module signing enabled but not in enforcing mode, we don't consider unsigned modules to be an error. However, we only mark sig_ok as true if a signature verified. This causes the module to be tainted with the TAINT_FORCED_MODULE flag. Wait, what?

[PATCH] MODSIGN: Don't taint unless signature enforcing is enabled

2013-01-04 Thread Josh Boyer
With module signing enabled but not in enforcing mode, we don't consider unsigned modules to be an error. However, we only mark sig_ok as true if a signature verified. This causes the module to be tainted with the TAINT_FORCED_MODULE flag. That in turn taints the kernel, which also disables

[PATCH] MODSIGN: Don't taint unless signature enforcing is enabled

2013-01-04 Thread Josh Boyer
With module signing enabled but not in enforcing mode, we don't consider unsigned modules to be an error. However, we only mark sig_ok as true if a signature verified. This causes the module to be tainted with the TAINT_FORCED_MODULE flag. That in turn taints the kernel, which also disables