Received: by 2002:a05:6a10:f3d0:0:0:0:0 with SMTP id a16csp3810786pxv; Mon, 28 Jun 2021 13:30:59 -0700 (PDT) X-Google-Smtp-Source: ABdhPJy9ElB/iJ2CnGlT2reDkcI/SpOVw1/WIcCOZEVERO3zer9dybOL6GItNwhCzXX3/kodcRTr X-Received: by 2002:a5d:9acd:: with SMTP id x13mr1012595ion.134.1624912259682; Mon, 28 Jun 2021 13:30:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1624912259; cv=none; d=google.com; s=arc-20160816; b=Ds6PSJ4kn38xECM4siw7UqmY/WkzgxMj58135g9NePNX3b6FGa0hIBQHorNMyF1QKW 5f0gER27wdwFLPaZLbDBh2imwQC6zbilrCL7zXDrpqNnt1hAq9gzffiYW17Dadhr/ld4 AlmjmjYfst7n0ncSXf9/9jBj07A84aQGnEeQLZKKlL8D9Uv0ig3PRVJouvsAWTSzzkvI ifOnNMERJl2wcXxFDCsTaePHKhXEcP2evQIvHCZVK1G6iFzo/2LQXQLRDUGr3vxfGMc/ 4wPXfL1oUifgi774yy461tLj0LCDFjxqkZ2TL0XlLv0W2KA4Oip7qG3hsSyL7MXCNYh4 Vzrw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=+XG71Z1jhwzmdAZ9d+3B0brMreBShoJ2kzvGuQzliPA=; b=FvMleeNkERB3ZBQFFWBmqUA8LuDq3rQk+Zc2BRc6CEkqiCOt+LnXljJ/M+Z+EooY34 HVsvx7VgwMQR4B0N9UPuRxH2XU/h62UH0sQR3TZCAxdLC2qUgmnrjBUITANF7PpQisxU IutwzQiU1zaOXzULh49evweMVjNJ3KkfKPmGpTVF1lh2dFDcrDlJCeHiJTn/s42Joedt zbyi6ic7/CPRNVvVdwhzanw9HPb+Uz+CwVj52il1pDW53HkxnQzJooN5zPh7c1gk2Lia qunLYUuLFv5C1Ci3uwEfbPWhiIzX0kDjNtbvrwdLGQofcrHzXOZr/bWvHqfO9s7+GxAT 8Q2A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=qlVdTBrM; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id p21si17787391jal.21.2021.06.28.13.30.34; Mon, 28 Jun 2021 13:30:59 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=qlVdTBrM; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237224AbhF1PF0 (ORCPT + 99 others); Mon, 28 Jun 2021 11:05:26 -0400 Received: from mail.kernel.org ([198.145.29.99]:51374 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235848AbhF1Opp (ORCPT ); Mon, 28 Jun 2021 10:45:45 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id BF74B61CE4; Mon, 28 Jun 2021 14:34:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1624890860; bh=6TbD/fNk0JSCvm1pT3u1oy4+HIV/lZeun77ZocXtP1c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qlVdTBrM0kle9Zp/KoFoaKr+qI/cCUv2Ij+Yn71ZIvv6YkNujhQQPSnA1FrFeWQsz 74qCd7q7w/fwk97BKB87vXAXoanQVtHidfjnbYzzFe8Vk4yu+4Cvtg4irp2qkAE983 /hfoQ487ygAQxWDwaw+vFCDczyJXvhiRgFIyN9c0yR2jSDnSIs2WK5LBEbhWWcfXC2 YEoELFsuBYpFTzIOvuTAIPK5WfslfC2abRHRqvGdOcAU0t5YsW2ly9JGmCMVjES3pD V2o1hmD3U+eDjalIoRKZMyIBQfk51DfUAlVYije2r5K8qNsp4tbNCxk6H6rhZvGx/d OjsoYO6yqTdMA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Mimi Zohar , Nayna Jain , Jessica Yu , Linus Torvalds , Sasha Levin Subject: [PATCH 4.19 083/109] module: limit enabling module.sig_enforce Date: Mon, 28 Jun 2021 10:32:39 -0400 Message-Id: <20210628143305.32978-84-sashal@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210628143305.32978-1-sashal@kernel.org> References: <20210628143305.32978-1-sashal@kernel.org> MIME-Version: 1.0 X-KernelTest-Patch: http://kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.196-rc1.gz X-KernelTest-Tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git X-KernelTest-Branch: linux-4.19.y X-KernelTest-Patches: git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git X-KernelTest-Version: 4.19.196-rc1 X-KernelTest-Deadline: 2021-06-30T14:32+00:00 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mimi Zohar [ Upstream commit 0c18f29aae7ce3dadd26d8ee3505d07cc982df75 ] Irrespective as to whether CONFIG_MODULE_SIG is configured, specifying "module.sig_enforce=1" on the boot command line sets "sig_enforce". Only allow "sig_enforce" to be set when CONFIG_MODULE_SIG is configured. This patch makes the presence of /sys/module/module/parameters/sig_enforce dependent on CONFIG_MODULE_SIG=y. Fixes: fda784e50aac ("module: export module signature enforcement status") Reported-by: Nayna Jain Tested-by: Mimi Zohar Tested-by: Jessica Yu Signed-off-by: Mimi Zohar Signed-off-by: Jessica Yu Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- kernel/module.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/module.c b/kernel/module.c index 92d8610742c7..68637e661d75 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -268,9 +268,18 @@ static void module_assert_mutex_or_preempt(void) #endif } +#ifdef CONFIG_MODULE_SIG static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE); module_param(sig_enforce, bool_enable_only, 0644); +void set_module_sig_enforced(void) +{ + sig_enforce = true; +} +#else +#define sig_enforce false +#endif + /* * Export sig_enforce kernel cmdline parameter to allow other subsystems rely * on that instead of directly to CONFIG_MODULE_SIG_FORCE config. -- 2.30.2