Re: [PATCH v5 07/14] module: Make module authentication usable without MODULE_SIG

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Misleading error message for generic authentication failures.
--

commit bd4ac969635e030618b66220b18c93b8a3a287e1
Author: Thomas Weißschuh <linux@weissschuh.net>
Subject: module: Make module authentication usable without MODULE_SIG

This commit splits module authentication functionality out from
CONFIG_MODULE_SIG into a more generic CONFIG_MODULE_AUTH. This change makes
the authentication functionality usable by both signature-based and the
upcoming hash-based module authentication.

> diff --git a/kernel/module/main.c b/kernel/module/main.c
> index 17a352198016a..cd8a74df117e7 100644
> --- a/kernel/module/main.c
> +++ b/kernel/module/main.c
> @@ -2601,10 +2601,10 @@ static void module_augment_kernel_taints(struct module *mod, struct load_info *i
>  				mod->name);
>  		add_taint_module(mod, TAINT_TEST, LOCKDEP_STILL_OK);
>  	}
> -#ifdef CONFIG_MODULE_SIG
> -	mod->sig_ok = info->sig_ok;
> -	if (!mod->sig_ok) {
> -		pr_notice_once("%s: module verification failed: signature "
> +#ifdef CONFIG_MODULE_AUTH
> +	mod->auth_ok = info->auth_ok;
> +	if (!mod->auth_ok) {
> +		pr_notice_once("%s: module authentication failed: signature "
>  			       "and/or required key missing - tainting "
>  			       "kernel\n", mod->name);

Since this infrastructure is being generalized to support hash-based
authentication, will this error message be misleading for modules that fail
hash verification where no PKCS7 signature or key is involved?

Could this be updated to reflect a more generic authentication failure?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260505-module-hashes-v5-0-e174a5a49fce@weissschuh.net?part=7