MODSIGN: Allow modules to be signed with an unknown key unless enforcing
Currently we fail the loading of modules that are signed with a public key
that is not in the modsign keyring even if we are not in enforcing mode.
This is somewhat at odds with the fact that we allow a completely unsigned
module to load in such a case.
We should allow modules signed with an unknown key to load in cases
where we are not enforcing and not in FIPS mode.
Signed-off-by: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed
