From c037a2c7df4bd0d933fcc3844462674ed4b834bf Mon Sep 17 00:00:00 2001 From: David Howells Date: Wed, 5 Apr 2017 17:40:30 +0100 Subject: [PATCH] Enforce module signatures if the kernel is locked down If the kernel is locked down, require that all modules have valid signatures that we can verify. Signed-off-by: David Howells Gbp-Pq: Topic features/all/lockdown Gbp-Pq: Name 0041-Enforce-module-signatures-if-the-kernel-is-locked-do.patch --- kernel/module.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/module.c b/kernel/module.c index de66ec82599..0ebd1a50322 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -2781,7 +2781,7 @@ static int module_sig_check(struct load_info *info, int flags) } /* Not having a signature is only an error if we're strict. */ - if (err == -ENOKEY && !sig_enforce) + if (err == -ENOKEY && !sig_enforce && !kernel_is_locked_down()) err = 0; return err; -- 2.30.2