Re: [PATCH V33 04/30] Enforce module signatures if the kernel is locked down

2019-06-20 Thread Kees Cook
On Thu, Jun 20, 2019 at 06:19:15PM -0700, Matthew Garrett wrote: > From: David Howells > > If the kernel is locked down, require that all modules have valid > signatures that we can verify. > > I have adjusted the errors generated: > > (1) If there's no signature (ENODATA) or we can't check it

[PATCH V33 04/30] Enforce module signatures if the kernel is locked down

2019-06-20 Thread Matthew Garrett
From: David Howells If the kernel is locked down, require that all modules have valid signatures that we can verify. I have adjusted the errors generated: (1) If there's no signature (ENODATA) or we can't check it (ENOPKG, ENOKEY), then: (a) If signatures are enforced then EKEYREJEC