module: signature checking hook

[cascardo/linux.git] / init / Kconfig

diff --git a/init/Kconfig b/init/Kconfig
index 66cc885..fa8ccad 100644 (file)
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1585,6 +1585,20 @@ config MODULE_SRCVERSION_ALL
          the version).  With this option, such a "srcversion" field
          will be created for all modules.  If unsure, say N.
 
+config MODULE_SIG
+       bool "Module signature verification"
+       depends on MODULES
+       help
+         Check modules for valid signatures upon load: the signature
+         is simply appended to the module. For more information see
+         Documentation/module-signing.txt.
+
+config MODULE_SIG_FORCE
+       bool "Require modules to be validly signed"
+       depends on MODULE_SIG
+       help
+         Reject unsigned modules or signed modules for which we don't have a
+         key.  Without this, such modules will simply taint the kernel.
 endif # MODULES
 
 config INIT_ALL_POSSIBLE