[PATCH v2 4/6] module: Move lockdown check into generic module loader

[Thomas Weißschuh]

The lockdown check buried in module_sig_check() will not compose well
with the introduction of hash-based module validation.
Move it into module_integrity_check() which will work better.

Signed-off-by: Thomas Weißschuh <li...@weissschuh.net>
---
 kernel/module/main.c    | 6 +++++-
 kernel/module/signing.c | 3 +--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/kernel/module/main.c b/kernel/module/main.c
index 
c0ab5c37f9710a0091320c4d171275e63be9217e..effe1db02973d4f60ff6cbc0d3b5241a3576fa3e
 100644
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -3221,7 +3221,11 @@ static int module_integrity_check(struct load_info 
*info, int flags)
        if (IS_ENABLED(CONFIG_MODULE_SIG))
                err = module_sig_check(info, flags);
 
-       return err;
+       if (err)
+               return err;
+       if (info->sig_ok)
+               return 0;
+       return security_locked_down(LOCKDOWN_MODULE_SIGNATURE);
 }
 
 /*
diff --git a/kernel/module/signing.c b/kernel/module/signing.c
index 
e51920605da14771601327ea596dad2e12400518..029e1ef6f0e369fd48e8c81154b6c697ad7a6249
 100644
--- a/kernel/module/signing.c
+++ b/kernel/module/signing.c
@@ -11,7 +11,6 @@
 #include <linux/module_signature.h>
 #include <linux/string.h>
 #include <linux/verification.h>
-#include <linux/security.h>
 #include <crypto/public_key.h>
 #include <uapi/linux/module.h>
 #include "internal.h"
@@ -100,5 +99,5 @@ int module_sig_check(struct load_info *info, int flags)
                return -EKEYREJECTED;
        }
 
-       return security_locked_down(LOCKDOWN_MODULE_SIGNATURE);
+       return 0;
 }

-- 
2.48.1