Re: [PATCH v3 7/9] module: Move lockdown check into generic module loader

[PATCH v3 0/9] module: Introduce hash-based integrity checking · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
[PATCH v3 4/9] kbuild: generate module BTF based on vmlinux.unstripped · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
[PATCH v3 1/9] powerpc/ima: Drop unnecessary check for CONFIG_MODULE_SIG · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
Re: [PATCH v3 1/9] powerpc/ima: Drop unnecessary check for CONFIG_MODULE_SIG · Mimi Zohar <zohar@linux.ibm.com> · 2025-05-14
[PATCH v3 6/9] module: Move integrity checks into dedicated function · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
[PATCH v3 5/9] module: Make module loading policy usable without MODULE_SIG · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
[PATCH v3 8/9] lockdown: Make the relationship to MODULE_SIG a dependency · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
Re: [PATCH v3 8/9] lockdown: Make the relationship to MODULE_SIG a dependency · Paul Moore <paul@paul-moore.com> · 2025-04-29
[PATCH v3 9/9] module: Introduce hash-based integrity checking · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
[PATCH v3 3/9] kbuild: add stamp file for vmlinux BTF data · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
[PATCH v3 2/9] ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
Re: [PATCH v3 2/9] ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG · Mimi Zohar <zohar@linux.ibm.com> · 2025-05-14
Re: [PATCH v3 2/9] ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG · Mimi Zohar <zohar@linux.ibm.com> · 2025-05-14
Re: [PATCH v3 2/9] ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG · Thomas Weißschuh <linux@weissschuh.net> · 2025-05-14
Re: [PATCH v3 2/9] ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG · Mimi Zohar <zohar@linux.ibm.com> · 2025-05-14
[PATCH v3 7/9] module: Move lockdown check into generic module loader · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
Re: [PATCH v3 7/9] module: Move lockdown check into generic module loader · Sebastian Andrzej Siewior <bigeasy@linutronix.de> · 2025-11-19
Re: [PATCH v3 7/9] module: Move lockdown check into generic module loader · Paul Moore <paul@paul-moore.com> · 2025-11-19
Re: [PATCH v3 7/9] module: Move lockdown check into generic module loader · Sebastian Andrzej Siewior <bigeasy@linutronix.de> · 2025-11-23
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · James Bottomley <James.Bottomley@HansenPartnership.com> · 2025-04-29
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Thomas Weißschuh <linux@weissschuh.net> · 2025-05-02
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · James Bottomley <James.Bottomley@HansenPartnership.com> · 2025-05-02
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · kpcyrd <hidden> · 2025-05-02
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · James Bottomley <James.Bottomley@HansenPartnership.com> · 2025-05-06
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Arnout Engelen <hidden> · 2025-05-03
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · James Bottomley <James.Bottomley@HansenPartnership.com> · 2025-05-06
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Arnout Engelen <hidden> · 2025-05-07
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · James Bottomley <James.Bottomley@HansenPartnership.com> · 2025-05-07
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Fabian Grünbichler <hidden> · 2025-05-08
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Sebastian Andrzej Siewior <bigeasy@linutronix.de> · 2025-11-19
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Sebastian Andrzej Siewior <hidden> · 2025-11-23
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Thomas Weißschuh <linux@weissschuh.net> · 2025-11-24
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Mimi Zohar <zohar@linux.ibm.com> · 2025-05-16

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date: 2025-11-19 11:20:59
Also in: linux-arch, linux-doc, linux-integrity, linux-kbuild, linux-modules, linux-security-module, lkml

On 2025-04-29 15:04:34 [+0200], Thomas Weißschuh wrote:

The lockdown check buried in module_sig_check() will not compose well
with the introduction of hash-based module validation.

An explanation of why would be nice.

Move it into module_integrity_check() which will work better.

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>

Sebastian

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help