From befc75e758df05dee767ca9dca21ae9d925be370 Mon Sep 17 00:00:00 2001 From: Ramji Jiyani Date: Sat, 8 Jan 2022 22:17:12 +0000 Subject: [PATCH] ANDROID: GKI: Disable security lockdown for unsigned modules By default with SELinux enabled behavior for unsigned module loading is same as sig_enforce=1. This causes loading of unsigned modules fail. All modules in Android GKI are unsigned except GKI modules. Do not prevent module loading in case of CONFIG_SIG_MODULE_PROTECT; which was introduced to change behavior of sig_enforce to allow unsigned modules but not access to protected symbols. Bug: 200082547 Bug: 214445388 Fixes: 9ab6a242258a ("ANDROID: GKI: Add module load time protected symbol lookup") Test: TreeHugger Signed-off-by: Ramji Jiyani Change-Id: Iab3113d706cbd7db7a5684897bcafd5671a6d424 --- kernel/module.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/module.c b/kernel/module.c index a3b2927404f4..cf31ab7e12f6 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -2960,7 +2960,15 @@ static int module_sig_check(struct load_info *info, int flags) return -EKEYREJECTED; } +/* + * ANDROID: GKI: Do not prevent loading of unsigned modules; + * as all modules except GKI modules are not signed. + */ +#ifndef CONFIG_MODULE_SIG_PROTECT return security_locked_down(LOCKDOWN_MODULE_SIGNATURE); +#else + return 0; +#endif } #else /* !CONFIG_MODULE_SIG */ static int module_sig_check(struct load_info *info, int flags)