Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <29a0bce7-0260-f403-a5d2-4a079aa14f3c@linux.microsoft.com>
Date:   Tue, 1 Feb 2022 07:34:40 -0500
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.5.1
Subject: Re: kmod and unsigned modules
Content-Language: en-US
To:     russell@coker.com.au,
        SELinux Reference Policy mailing list 
        <selinux-refpolicy@vger.kernel.org>
References: <8839796.NKUDOvIH9j@xev>
From:   Chris PeBenito <chpebeni@linux.microsoft.com>
In-Reply-To: <8839796.NKUDOvIH9j@xev>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 2/1/2022 04:29, Russell Coker wrote:
> [    9.002945] audit: type=1400 audit(1643707510.152:4): avc:  denied  {
> integrity } for  pid=371 comm="modprobe" lockdown_reason="unsigned module
> loading" scontext=system_u:system_r:kmod_t:s0
> tcontext=system_u:system_r:kmod_t:s0 tclass=lockdown permissive=0
> 
> We need to have a boolean for this.  Just sending email so I don't forget it.

Switching to the refpolicy mail list.

The lockdown checks were removed in 5.16.  IMO we should allow all 
domains both lockdown permissions until the lockdown class in the policy 
is removed.


--
Chris PeBenito