enforce kernel module software signature verification [module signing] / disallow kernel module loading by default

[Patrick]

Reconsidering.

@Patrick

Or better a more generic solution of signing all DKMS modules:

• https://gist.github.com/dop3j0e/2a9e2dddca982c4f679552fc1ebb18df

@madaidan

I don’t think this should be done.

Better to sign all kernel modules (this would be helpful for purpose of LKRG, tirdad and hardware comparability, namely compatibility with SecureBoot) than no progress in this ticket at all and no signing at all. A drop-in configuration .d folder where kernel modules are white listed opted in could be contributed later.

@madaidan

I think we should only allow the modules we need to make the chance something malicious is accidentally signed at a minimum.

Please describe the threat model. Folders where kernel modules are stored (and would be auto-signed) are writeable by (super)admin only anyhow. If an adversary gains write access there, it’s game over anyhow. Therefore I don’t see what is gained by white listing which kernel modules should be signed.