module: limit enabling module.sig_enforce
authorMimi Zohar <zohar@linux.ibm.com>
Tue, 22 Jun 2021 11:36:41 +0000 (13:36 +0200)
committerLinus Torvalds <torvalds@linux-foundation.org>
Tue, 22 Jun 2021 18:13:19 +0000 (11:13 -0700)
commit0c18f29aae7ce3dadd26d8ee3505d07cc982df75
tree51bdd30e0767c17e9f617eda0b6440ac1085fe39
parenta96bfed64c8986d6404e553f18203cae1f5ac7e6
module: limit enabling module.sig_enforce

Irrespective as to whether CONFIG_MODULE_SIG is configured, specifying
"module.sig_enforce=1" on the boot command line sets "sig_enforce".
Only allow "sig_enforce" to be set when CONFIG_MODULE_SIG is configured.

This patch makes the presence of /sys/module/module/parameters/sig_enforce
dependent on CONFIG_MODULE_SIG=y.

Fixes: fda784e50aac ("module: export module signature enforcement status")
Reported-by: Nayna Jain <nayna@linux.ibm.com>
Tested-by: Mimi Zohar <zohar@linux.ibm.com>
Tested-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
kernel/module.c