Re: [PATCH v5 02/14] lockdown: Make the relationship to MODULE_SIG a dependency

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Replacing `select` with `depends on` silently disables Kernel Lockdown (`CONFIG_SECURITY_LOCKDOWN_LSM`) in existing defconfigs.
--

commit fc97135b538c64bfcbf058cc70c9665d00e5bb18
Author: Thomas Weißschuh <linux@weissschuh.net>

lockdown: Make the relationship to MODULE_SIG a dependency

This commit changes the relationship between SECURITY_LOCKDOWN_LSM and
MODULE_SIG from a select to a depends on. This is intended to allow for
future hash-based module integrity checking alternatives.

> diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig
> index e84ddf4840101..155959205b8ea 100644
> --- a/security/lockdown/Kconfig
> +++ b/security/lockdown/Kconfig
> @@ -1,7 +1,7 @@
>  config SECURITY_LOCKDOWN_LSM
>  	bool "Basic module for enforcing kernel lockdown"
>  	depends on SECURITY
> -	select MODULE_SIG if MODULES
> +	depends on !MODULES || MODULE_SIG

Will this change silently disable CONFIG_SECURITY_LOCKDOWN_LSM in existing
defconfigs?

Because Kconfig's savedefconfig strips out automatically selected symbols,
many in-tree defconfigs contain CONFIG_SECURITY_LOCKDOWN_LSM=y but omit
CONFIG_MODULE_SIG=y. Since CONFIG_MODULE_SIG has no default y, it will
initialize to n.

With CONFIG_MODULES=y and CONFIG_MODULE_SIG=n, this new dependency evaluates
to n. As a result, Kconfig will drop CONFIG_SECURITY_LOCKDOWN_LSM from the
final configuration without any warnings, leaving the kernel unprotected by
lockdown. This also degrades discoverability, hiding the Lockdown LSM in
menuconfig unless a user explicitly enables MODULE_SIG first.

Could this be handled with a conditional select instead to avoid breaking
existing configurations while still supporting the upcoming MODULE_HASHES
feature? For example:

select MODULE_SIG if MODULES && !MODULE_HASHES

>  	help
>  	  Build support for an LSM that enforces a coarse kernel lockdown
>  	  behaviour.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260505-module-hashes-v5-0-e174a5a49fce@weissschuh.net?part=2