Re: [PATCH V40 04/29] lockdown: Enforce module signatures if the kernel is locked down

[David Howells]

Matthew Garrett <matthewgarrett@xxxxxxxxxx> wrote:

>  enum lockdown_reason {
>  	LOCKDOWN_NONE,
> +	LOCKDOWN_MODULE_SIGNATURE,
>  	LOCKDOWN_INTEGRITY_MAX,
>  	LOCKDOWN_CONFIDENTIALITY_MAX,
>  };

Aren't you mixing disjoint sets?

> +	[LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading",

Wouldn't it be better to pass this string as a parameter to
security_locked_down()?

David