[PATCH 04/24] Enforce module signatures if the kernel is locked down

2018-04-11 Thread David Howells
If the kernel is locked down, require that all modules have valid signatures that we can verify or that IMA can validate the file. I have adjusted the errors generated: (1) If there's no signature (ENODATA) or we can't check it (ENOPKG, ENOKEY), then: (a) If signatures are enforced

[PATCH 04/24] Enforce module signatures if the kernel is locked down

2018-04-11 Thread David Howells
If the kernel is locked down, require that all modules have valid signatures that we can verify or that IMA can validate the file. I have adjusted the errors generated: (1) If there's no signature (ENODATA) or we can't check it (ENOPKG, ENOKEY), then: (a) If signatures are enforced

[PATCH 04/24] Enforce module signatures if the kernel is locked down

2017-04-05 Thread David Howells
If the kernel is locked down, require that all modules have valid signatures that we can verify. Signed-off-by: David Howells --- kernel/module.c |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/module.c b/kernel/module.c index

[PATCH 04/24] Enforce module signatures if the kernel is locked down

2017-04-05 Thread David Howells
If the kernel is locked down, require that all modules have valid signatures that we can verify. Signed-off-by: David Howells --- kernel/module.c |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/module.c b/kernel/module.c index 7eba6dea4f41..3331f2eb9b93 100644 ---

[PATCH 04/24] Enforce module signatures if the kernel is locked down

2017-04-05 Thread David Howells
If the kernel is locked down, require that all modules have valid signatures that we can verify. Signed-off-by: David Howells --- kernel/module.c |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/module.c b/kernel/module.c index

[PATCH 04/24] Enforce module signatures if the kernel is locked down

2017-04-05 Thread David Howells
If the kernel is locked down, require that all modules have valid signatures that we can verify. Signed-off-by: David Howells --- kernel/module.c |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/module.c b/kernel/module.c index 7eba6dea4f41..3331f2eb9b93 100644 ---

[PATCH 04/24] Enforce module signatures if the kernel is locked down

2017-04-05 Thread David Howells
If the kernel is locked down, require that all modules have valid signatures that we can verify. Signed-off-by: David Howells --- kernel/module.c |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/module.c b/kernel/module.c index

[PATCH 04/24] Enforce module signatures if the kernel is locked down

2017-04-05 Thread David Howells
If the kernel is locked down, require that all modules have valid signatures that we can verify. Signed-off-by: David Howells --- kernel/module.c |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/module.c b/kernel/module.c index 7eba6dea4f41..3331f2eb9b93 100644 ---