summaryrefslogtreecommitdiff
path: root/init
diff options
context:
space:
mode:
authorThiago Jung Bauermann <bauerman@linux.ibm.com>2019-07-04 15:57:34 -0300
committerMimi Zohar <zohar@linux.ibm.com>2019-08-05 18:39:56 -0400
commitc8424e776b093280d3fdd104d850706b3b229ac8 (patch)
tree3f14381fe576439fa1fa94736b67d1015c40752d /init
parentb36f281f4a314de4be0a51d6511b794691f8a244 (diff)
MODSIGN: Export module signature definitions
IMA will use the module_signature format for append signatures, so export the relevant definitions and factor out the code which verifies that the appended signature trailer is valid. Also, create a CONFIG_MODULE_SIG_FORMAT option so that IMA can select it and be able to use mod_check_sig() without having to depend on either CONFIG_MODULE_SIG or CONFIG_MODULES. s390 duplicated the definition of struct module_signature so now they can use the new <linux/module_signature.h> header instead. Signed-off-by: Thiago Jung Bauermann <bauerman@linux.ibm.com> Acked-by: Jessica Yu <jeyu@kernel.org> Reviewed-by: Philipp Rudo <prudo@linux.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'init')
-rw-r--r--init/Kconfig6
1 files changed, 5 insertions, 1 deletions
diff --git a/init/Kconfig b/init/Kconfig
index bd7d650d4a99..2dca877c9ed7 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1930,6 +1930,10 @@ config BASE_SMALL
default 0 if BASE_FULL
default 1 if !BASE_FULL
+config MODULE_SIG_FORMAT
+ def_bool n
+ select SYSTEM_DATA_VERIFICATION
+
menuconfig MODULES
bool "Enable loadable module support"
option modules
@@ -2007,7 +2011,7 @@ config MODULE_SRCVERSION_ALL
config MODULE_SIG
bool "Module signature verification"
depends on MODULES
- select SYSTEM_DATA_VERIFICATION
+ select MODULE_SIG_FORMAT
help
Check modules for valid signatures upon load: the signature
is simply appended to the module. For more information see