Re: [PATCH] MODSIGN: Add TAINT_NOKEY_MODULE

Josh Boyer
2013-01-16T13:21:38Z

On Wed, Jan 16, 2013 at 02:04:50PM +1030, Rusty Russell wrote:
> Josh Boyer <jwboyer@redhat.com> writes:
> > With module signing enabled but not in enforcing mode, we don't consider
> > unsigned modules to be an error. However, if we encounter an unsigned
> > module we currently taint the module and kernel with TAINT_FORCED_MODULE.
> > That also disables lockdep within the kernel.
>
> How about this, instead? Ingo?

That would work for me for the lockdep issue, sure. I thought I'd make
the unsigned/wrong key module case a bit more clear at the same time.
Do you think that's worth doing aside from lockdep? If so, and your
patch seems acceptable to others, I'd be happy to respin my patch on
top.

I'll give your patch a test in just a bit.

josh