Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <8839796.NKUDOvIH9j@xev> <29a0bce7-0260-f403-a5d2-4a079aa14f3c@linux.microsoft.com>
In-Reply-To: <29a0bce7-0260-f403-a5d2-4a079aa14f3c@linux.microsoft.com>
From:   Paul Moore <paul@paul-moore.com>
Date:   Tue, 1 Feb 2022 09:14:06 -0500
Message-ID: <CAHC9VhRae+bD4VbVRNLhSDhGSxYYEhaO5v1M2-qiNS=0-MdbeQ@mail.gmail.com>
Subject: Re: kmod and unsigned modules
To:     Chris PeBenito <chpebeni@linux.microsoft.com>
Cc:     russell@coker.com.au,
        SELinux Reference Policy mailing list 
        <selinux-refpolicy@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Tue, Feb 1, 2022 at 7:34 AM Chris PeBenito
<chpebeni@linux.microsoft.com> wrote:
>
> On 2/1/2022 04:29, Russell Coker wrote:
> > [    9.002945] audit: type=1400 audit(1643707510.152:4): avc:  denied  {
> > integrity } for  pid=371 comm="modprobe" lockdown_reason="unsigned module
> > loading" scontext=system_u:system_r:kmod_t:s0
> > tcontext=system_u:system_r:kmod_t:s0 tclass=lockdown permissive=0
> >
> > We need to have a boolean for this.  Just sending email so I don't forget it.
>
> Switching to the refpolicy mail list.
>
> The lockdown checks were removed in 5.16.  IMO we should allow all
> domains both lockdown permissions until the lockdown class in the policy
> is removed.

For reference, here is the related discussion thread:

https://lore.kernel.org/selinux/163243191040.178880.4295195865966623164.stgit@olly

-- 
paul-moore.com