Re: kmod and unsigned modules
Chris PeBenito <[email protected]>
| Newsgroups | org.kernel.vger.selinux-refpolicy,org.kernel.vger.selinux |
|---|---|
| Message-ID | <[email protected]> |
On 2/1/2022 04:29, Russell Coker wrote:
> [ 9.002945] audit: type=1400 audit(1643707510.152:4): avc: denied {
> integrity } for pid=371 comm="modprobe" lockdown_reason="unsigned module
> loading" scontext=system_u:system_r:kmod_t:s0
> tcontext=system_u:system_r:kmod_t:s0 tclass=lockdown permissive=0
>
> We need to have a boolean for this. Just sending email so I don't forget it.
Switching to the refpolicy mail list.
The lockdown checks were removed in 5.16. IMO we should allow all
domains both lockdown permissions until the lockdown class in the policy
is removed.
--
Chris PeBenito