Re: [PATCH v3 7/9] module: Move lockdown check into generic module loader

[PATCH v3 0/9] module: Introduce hash-based integrity checking · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
[PATCH v3 4/9] kbuild: generate module BTF based on vmlinux.unstripped · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
[PATCH v3 1/9] powerpc/ima: Drop unnecessary check for CONFIG_MODULE_SIG · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
Re: [PATCH v3 1/9] powerpc/ima: Drop unnecessary check for CONFIG_MODULE_SIG · Mimi Zohar <zohar@linux.ibm.com> · 2025-05-14
[PATCH v3 6/9] module: Move integrity checks into dedicated function · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
[PATCH v3 5/9] module: Make module loading policy usable without MODULE_SIG · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
[PATCH v3 8/9] lockdown: Make the relationship to MODULE_SIG a dependency · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
Re: [PATCH v3 8/9] lockdown: Make the relationship to MODULE_SIG a dependency · Paul Moore <paul@paul-moore.com> · 2025-04-29
[PATCH v3 9/9] module: Introduce hash-based integrity checking · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
[PATCH v3 3/9] kbuild: add stamp file for vmlinux BTF data · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
[PATCH v3 2/9] ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
Re: [PATCH v3 2/9] ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG · Mimi Zohar <zohar@linux.ibm.com> · 2025-05-14
Re: [PATCH v3 2/9] ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG · Mimi Zohar <zohar@linux.ibm.com> · 2025-05-14
Re: [PATCH v3 2/9] ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG · Thomas Weißschuh <linux@weissschuh.net> · 2025-05-14
Re: [PATCH v3 2/9] ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG · Mimi Zohar <zohar@linux.ibm.com> · 2025-05-14
[PATCH v3 7/9] module: Move lockdown check into generic module loader · Thomas Weißschuh <linux@weissschuh.net> · 2025-04-29
Re: [PATCH v3 7/9] module: Move lockdown check into generic module loader · Sebastian Andrzej Siewior <bigeasy@linutronix.de> · 2025-11-19
Re: [PATCH v3 7/9] module: Move lockdown check into generic module loader · Paul Moore <paul@paul-moore.com> · 2025-11-19
Re: [PATCH v3 7/9] module: Move lockdown check into generic module loader · Sebastian Andrzej Siewior <bigeasy@linutronix.de> · 2025-11-23
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · James Bottomley <James.Bottomley@HansenPartnership.com> · 2025-04-29
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Thomas Weißschuh <linux@weissschuh.net> · 2025-05-02
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · James Bottomley <James.Bottomley@HansenPartnership.com> · 2025-05-02
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · kpcyrd <hidden> · 2025-05-02
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · James Bottomley <James.Bottomley@HansenPartnership.com> · 2025-05-06
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Arnout Engelen <hidden> · 2025-05-03
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · James Bottomley <James.Bottomley@HansenPartnership.com> · 2025-05-06
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Arnout Engelen <hidden> · 2025-05-07
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · James Bottomley <James.Bottomley@HansenPartnership.com> · 2025-05-07
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Fabian Grünbichler <hidden> · 2025-05-08
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Sebastian Andrzej Siewior <bigeasy@linutronix.de> · 2025-11-19
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Sebastian Andrzej Siewior <hidden> · 2025-11-23
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Thomas Weißschuh <linux@weissschuh.net> · 2025-11-24
Re: [PATCH v3 0/9] module: Introduce hash-based integrity checking · Mimi Zohar <zohar@linux.ibm.com> · 2025-05-16

From: Paul Moore <paul@paul-moore.com>
Date: 2025-11-19 19:55:59
Also in: linux-arch, linux-doc, linux-integrity, linux-kbuild, linux-modules, linux-security-module, lkml

On Wed, Nov 19, 2025 at 6:20 AM Sebastian Andrzej Siewior
[off-list ref] wrote:

On 2025-04-29 15:04:34 [+0200], Thomas Weißschuh wrote:

quoted

The lockdown check buried in module_sig_check() will not compose well
with the introduction of hash-based module validation.

An explanation of why would be nice.

/me shrugs

I thought the explanation was sufficient.

quoted

Move it into module_integrity_check() which will work better.

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>

-- 
paul-moore.com

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help