/sys/kernel/security/modsign/enforce gives the result of current
enforcement policy of loading module.

Signed-off-by: Jia Zhang <zhang....@linux.alibaba.com>
---
 kernel/module.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/kernel/module.c b/kernel/module.c
index 79825ea..6b032577 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2794,11 +2794,60 @@ static int module_sig_check(struct load_info *info, int 
flags)
 
        return err;
 }
+
+#ifdef CONFIG_SECURITYFS
+static ssize_t modsign_enforce_read(struct file *filp, char __user *ubuf,
+                                   size_t count, loff_t *offp)
+{
+       char buf[2];
+
+       sprintf(buf, "%d", is_module_sig_enforced());
+
+       return simple_read_from_buffer(ubuf, count, offp, buf, 1);
+}
+
+static const struct file_operations modsign_enforce_ops = {
+       .read = modsign_enforce_read,
+       .llseek = generic_file_llseek,
+};
+
+static int __init securityfs_init(void)
+{
+       struct dentry *modsign_dir;
+       struct dentry *enforce;
+
+       modsign_dir = securityfs_create_dir("modsign", NULL);
+       if (IS_ERR(modsign_dir))
+               return -1;
+
+       enforce = securityfs_create_file("enforce",
+                                        S_IRUSR | S_IRGRP, modsign_dir,
+                                        NULL, &modsign_enforce_ops);
+       if (IS_ERR(enforce))
+               goto out;
+
+       return 0;
+out:
+       securityfs_remove(modsign_dir);
+
+       return -1;
+}
+#else /* !CONFIG_SECURITYFS */
+static int __init securityfs_init(void)
+{
+       return 0;
+}
+#endif
 #else /* !CONFIG_MODULE_SIG */
 static int module_sig_check(struct load_info *info, int flags)
 {
        return 0;
 }
+
+static int __init securityfs_init(void)
+{
+       return 0;
+}
 #endif /* !CONFIG_MODULE_SIG */
 
 /* Sanity checks against invalid binaries, wrong arch, weird elf version. */
@@ -4395,8 +4444,14 @@ void module_layout(struct module *mod,
 
 static int __init initialize_module(void)
 {
+       int ret;
+
        proc_modules_init();
 
+       ret = securityfs_init();
+       if (unlikely(ret))
+               return ret;
+
        return 0;
 }
 module_init(initialize_module);
-- 
1.8.3.1

Reply via email to