summaryrefslogtreecommitdiff
path: root/include/linux/module.h
diff options
context:
space:
mode:
authorMimi Zohar <zohar@linux.ibm.com>2019-01-28 03:03:45 +0300
committerMimi Zohar <zohar@linux.ibm.com>2019-03-27 17:36:44 +0300
commit8db5da0b8618df79eceea99672e205d4a2a6309e (patch)
tree0c2f55e5fc3827130bc7a9b389fde8c4d24261b2 /include/linux/module.h
parent8d93e952fba216cd0811247f6360d97e0465d5fc (diff)
downloadlinux-8db5da0b8618df79eceea99672e205d4a2a6309e.tar.xz
x86/ima: require signed kernel modules
Have the IMA architecture specific policy require signed kernel modules on systems with secure boot mode enabled; and coordinate the different signature verification methods, so only one signature is required. Requiring appended kernel module signatures may be configured, enabled on the boot command line, or with this patch enabled in secure boot mode. This patch defines set_module_sig_enforced(). To coordinate between appended kernel module signatures and IMA signatures, only define an IMA MODULE_CHECK policy rule if CONFIG_MODULE_SIG is not enabled. A custom IMA policy may still define and require an IMA signature. Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Reviewed-by: Luis Chamberlain <mcgrof@kernel.org> Acked-by: Jessica Yu <jeyu@kernel.org>
Diffstat (limited to 'include/linux/module.h')
-rw-r--r--include/linux/module.h5
1 files changed, 5 insertions, 0 deletions
diff --git a/include/linux/module.h b/include/linux/module.h
index 5bf5dcd91009..73ee2b10e816 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -676,6 +676,7 @@ static inline bool is_livepatch_module(struct module *mod)
#endif /* CONFIG_LIVEPATCH */
bool is_module_sig_enforced(void);
+void set_module_sig_enforced(void);
#else /* !CONFIG_MODULES... */
@@ -796,6 +797,10 @@ static inline bool is_module_sig_enforced(void)
return false;
}
+static inline void set_module_sig_enforced(void)
+{
+}
+
/* Dereference module function descriptor */
static inline
void *dereference_module_function_descriptor(struct module *mod, void *ptr)