On Thu, Sep 14, 2023 at 11:27:38AM +0000, Alessandro Carminati (Red Hat) wrote: > This commit introduces a novel boot argument parameter that provides an > advanced level of control over the verification of module signatures > during the initial stages of booting. With this enhancement, we gain the > capability to postpone the verification of module signatures to after > intrd stage is finished. > > Given that bootloader-provided artifacts are commonly employed > post-verification, Is such a thing expressed with a kernel config? If so then shouldn't this be default for those uses cases? > Signed-off-by: Alessandro Carminati (Red Hat) <alessandro.carminati@xxxxxxxxx> > --- > include/linux/module.h | 4 +++ > kernel/module/main.c | 14 ++++++----- > kernel/module/signing.c | 56 +++++++++++++++++++++++++++++++++++++++++ > 3 files changed, 68 insertions(+), 6 deletions(-) > > diff --git a/include/linux/module.h b/include/linux/module.h > index a98e188cf37b..9899aeac43b0 100644 > --- a/include/linux/module.h > +++ b/include/linux/module.h > @@ -34,6 +34,10 @@ > > #define MODULE_NAME_LEN MAX_PARAM_PREFIX_LEN > > +#ifdef CONFIG_MODULE_SIG > +extern int module_sig_check_wait; > +#endif Please add under is_module_sig_enforced. That's one new line Vs 3 new ones. I see the code which skips module signature verification and the knobs but I don't see the code which complete the promise to do the actual signature verification post initrd / initramfs state. What gives? Luis
