sign kernel modules

[phabricator-migrator]

Information

ID: 951
PHID: PHID-TASK-irppfgnihrhhoabkpf5w
Author: Patrick
Status at Migration Time: open
Priority at Migration Time: Normal

Description

Sign lkrg, tirdad, VirtualBox guest additions.

/usr/lib/linux-kbuild-4.19/scripts/sign-file

That would allow us to enable kernel lockdown. (T670)

enforce kernel module software signature verification [module signing] / disallow kernel module loading by default

We can restrict kernel modules to only be loaded if they’re signed by a valid key. This increases security by making it harder to load a malicious module. We can do this by adding module.sig_enforce=1 as a kernel parameter. https://www.kernel.org/doc/html/v4.19/admin-guide/module-signing.html We can also prevent kernel modules from being loaded or unloaded after boot by setting kernel.modules_disabled=1 with sysctl. I don’t really see a point in this though as module loading requires root and …

Comments