Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux...

[~andy/linux] / security / integrity / ima / ima_main.c

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 3e751a9743a1896365b8ef730b77603074e2ee91..5127afcc4b8982a4353b87ccc5f4542ec7862f39 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -282,8 +282,13 @@ EXPORT_SYMBOL_GPL(ima_file_check);
  */
 int ima_module_check(struct file *file)
 {
-       if (!file)
-               return -EACCES; /* INTEGRITY_UNKNOWN */
+       if (!file) {
+#ifndef CONFIG_MODULE_SIG_FORCE
+               if (ima_appraise & IMA_APPRAISE_MODULES)
+                       return -EACCES; /* INTEGRITY_UNKNOWN */
+#endif
+               return 0;       /* We rely on module signature checking */
+       }
        return process_measurement(file, file->f_dentry->d_name.name,
                                   MAY_EXEC, MODULE_CHECK);
 }