Re: [PATCH 03/27] Enforce module signatures if the kernel is locked down

[David Howells]

Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx> wrote:

> This kernel_is_locked_down() check is being called for both the
> original and new module_load syscalls. ÂWe need to be able
> differentiate them. ÂThis is fine for the original syscall, but for
> the new syscall we would need an additional IMA check -
> !is_ima_appraise_enabled().

IMA can only be used with finit_module()?

David