linux-next

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-18 22:34:48 +00:00

History

Bruno E. O. Meneguele 7c9bc0983f ima: check signature enforcement against cmdline param instead of CONFIG

When the user requests MODULE_CHECK policy and its kernel is compiled
with CONFIG_MODULE_SIG_FORCE not set, all modules would not load, just
those loaded in initram time. One option the user would have would be
set a kernel cmdline param (module.sig_enforce) to true, but the IMA
module check code doesn't rely on this value, it checks just
CONFIG_MODULE_SIG_FORCE.

This patch solves this problem checking for the exported value of
module.sig_enforce cmdline param intead of CONFIG_MODULE_SIG_FORCE,
which holds the effective value (CONFIG || param).

Signed-off-by: Bruno E. O. Meneguele <brdeoliv@redhat.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

2017-11-08 15:16:36 -05:00

apparmor

+ Features

2017-09-23 05:33:29 -10:00

integrity

ima: check signature enforcement against cmdline param instead of CONFIG

2017-11-08 15:16:36 -05:00

keys

fs: fix kernel_write prototype

2017-09-04 19:05:15 -04:00

loadpin

security: mark LSM hooks as __ro_after_init