[PATCH 4/4] module: Allow to upgrade to validity enforcement in unforced mode

[Jia Zhang]

If module signature verification check is enabled but the
validity enforcement is configured to be disabled, it should
be allowed to enable it. Once enabled, it is disallowed to
disable it.

Signed-off-by: Jia Zhang <zhang.jia@xxxxxxxxxxxxxxxxx>
---
 kernel/module.c | 39 ++++++++++++++++++++++++++++++++++++---
 1 file changed, 36 insertions(+), 3 deletions(-)

diff --git a/kernel/module.c b/kernel/module.c
index e3c6c8e..89704df 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2806,8 +2806,37 @@ static ssize_t modsign_enforce_read(struct file *filp, char __user *ubuf,
 	return simple_read_from_buffer(ubuf, count, offp, buf, 1);
 }
 
+#ifndef CONFIG_MODULE_SIG_FORCE
+static ssize_t modsign_enforce_write(struct file *filp,
+				     const char __user *ubuf,
+				     size_t count, loff_t *offp)
+{
+	char buf;
+	ssize_t ret;
+
+	if (*offp > 1)
+		return -EFBIG;
+
+	ret = simple_write_to_buffer(&buf, 1, offp, ubuf, count);
+	if (ret > 0) {
+		if (buf != '1')
+			return -EINVAL;
+
+		sig_enforce = true;
+		pr_notice_once("Kernel module validity enforcement enabled\n");
+
+		ret = count;
+	}
+
+	return ret;
+}
+#endif
+
 static const struct file_operations modsign_enforce_ops = {
 	.read = modsign_enforce_read,
+#ifndef CONFIG_MODULE_SIG_FORCE
+	.write = modsign_enforce_write,
+#endif
 	.llseek = generic_file_llseek,
 };
 
@@ -2815,14 +2844,18 @@ static int __init securityfs_init(void)
 {
 	struct dentry *modsign_dir;
 	struct dentry *enforce;
+	umode_t mode;
 
 	modsign_dir = securityfs_create_dir("modsign", NULL);
 	if (IS_ERR(modsign_dir))
 		return -1;
 
-	enforce = securityfs_create_file("enforce",
-					 S_IRUSR | S_IRGRP, modsign_dir,
-					 NULL, &modsign_enforce_ops);
+	mode = S_IRUSR | S_IRGRP;
+	if (!sig_enforce)
+		mode |= S_IWUSR;
+
+	enforce = securityfs_create_file("enforce", mode, modsign_dir, NULL,
+					 &modsign_enforce_ops);
 	if (IS_ERR(enforce))
 		goto out;
 
-- 
1.8.3.1