From 8c7580cfcf3d0653a95120a3e3ceaa7c1f6786da Mon Sep 17 00:00:00 2001 From: David Howells Date: Wed, 5 Apr 2017 17:40:30 +0100 Subject: [PATCH] Enforce module signatures if the kernel is locked down If the kernel is locked down, require that all modules have valid signatures that we can verify. Signed-off-by: David Howells Gbp-Pq: Topic features/all/lockdown Gbp-Pq: Name 0041-Enforce-module-signatures-if-the-kernel-is-locked-do.patch --- kernel/module.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/module.c b/kernel/module.c index 40f983cbea8..e5b878b2690 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -2781,7 +2781,7 @@ static int module_sig_check(struct load_info *info, int flags) } /* Not having a signature is only an error if we're strict. */ - if (err == -ENOKEY && !sig_enforce) + if (err == -ENOKEY && !sig_enforce && !kernel_is_locked_down()) err = 0; return err; -- 2.30.2