Re: [PATCH] module: Allow to disable modsign in kernel cmdline

[Tianjia Zhang]

On 2020/4/28 11:47, Randy Dunlap wrote:
> On 4/27/20 8:43 PM, Tianjia Zhang wrote:
> > This change allows to disable modsign completely at the beginning,
> > and turn off by set the kernel cmdline `no_modsig_enforce` when
> > CONFIG_MODULE_SIG_FORCE is enabled.
> >
> > Yet another change allows to always show the current status of
> > modsign through `/sys/module/module/parameters/sig_enforce`.
> >
> > Signed-off-by: Jia Zhang <zhang.jia@xxxxxxxxxxxxxxxxx>
> > Signed-off-by: Tianjia Zhang <tianjia.zhang@xxxxxxxxxxxxxxxxx>
> > ---
> >   kernel/module.c | 8 ++++++++
> >   1 file changed, 8 insertions(+)
> >
> > diff --git a/kernel/module.c b/kernel/module.c
> > index 646f1e2330d2..0e68e1286377 100644
> > --- a/kernel/module.c
> > +++ b/kernel/module.c
> > @@ -269,6 +269,14 @@ static void module_assert_mutex_or_preempt(void)
> >   
> >   static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);
> >   module_param(sig_enforce, bool_enable_only, 0644);
> > +#ifdef CONFIG_MODULE_SIG_FORCE
> > +static int __init set_no_modsig_enforce(char *str)
> > +{
> > +	sig_enforce = false;
> > +	return 1;
> > +}
> > +__setup("no_modsig_enforce", set_no_modsig_enforce);
> > +#endif /* !CONFIG_MODULE_SIG_FORCE */
> >   
> >   /*
> >    * Export sig_enforce kernel cmdline parameter to allow other subsystems rely
>
> Hi,
> Please document this cmdline option, probably in
> Documentation/admin-guide/kernel-parameters.txt.
>
> thanks.

Thanks for your information, I will submit a v2 patch.

Thanks and best,
Tianjia