kernel-6.1/0001-ROSA-ima-allow-to-off-modules-signature-check-dynami.patch

From 202c591714b08df9b9e12e362a1b2b86692f021f Mon Sep 17 00:00:00 2001
From: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
Date: Mon, 10 Aug 2020 10:38:20 +0300
Subject: [PATCH] ROSA: ima: allow to off modules signature check dynamically

Allow module.sig_enforce=0 kernel cmdline, not only module.sig_enforce=1
It allows to keep CONFIG_MODULE_SIG_FORCE=y, but disable it when really needed
without recompiling the kernel (it may be impossible, e.g. in certified systems).

GRUB or another bootloader is password-protected when needed,
so I am not afraid much that someone will be able to turn it off when not needed.

ROSA-specific patch.
This violates requirements of "secure boot", but currently we do not have secure boot in ROSA.

Signed-off-by: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
---
 kernel/module/signing.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/module/signing.c b/kernel/module/signing.c
index a2ff4242e623..c81ee6b6380e 100644
--- a/kernel/module/signing.c
+++ b/kernel/module/signing.c
@@ -20,7 +20,7 @@
 #define MODULE_PARAM_PREFIX "module."
 
 static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);
-module_param(sig_enforce, bool_enable_only, 0644);
+module_param(sig_enforce, bool, 0644);
 
 /*
  * Export sig_enforce kernel cmdline parameter to allow other subsystems rely
-- 
2.35.2