linux.git/include/linux/module_signature.h, branch v7.1-rc5

module: Move 'struct module_signature' to UAPI

2026-03-24T21:42:37+00:00

This structure definition is used outside the kernel proper.
For example in kmod and the kernel build environment.

To allow reuse, move it to a new UAPI header.

While it is not a true UAPI, it is a common practice to have
non-UAPI interface definitions in the kernel's UAPI headers.

Signed-off-by: Thomas Weißschuh 
Reviewed-by: Petr Pavlu 
Reviewed-by: Nicolas Schier 
Signed-off-by: Sami Tolvanen

module: Give MODULE_SIG_STRING a more descriptive name

2026-03-24T21:42:37+00:00

The purpose of the constant it is not entirely clear from its name.

As this constant is going to be exposed in a UAPI header, give it a more
specific name for clarity. As all its users call it 'marker', use that
wording in the constant itself.

Signed-off-by: Thomas Weißschuh 
Reviewed-by: Petr Pavlu 
Reviewed-by: Nicolas Schier 
Signed-off-by: Sami Tolvanen

module: Give 'enum pkey_id_type' a more specific name

2026-03-24T21:42:37+00:00

This enum originates in generic cryptographic code and has a very
generic name. Nowadays it is only used for module signatures.

As this enum is going to be exposed in a UAPI header, give it a more
specific name for clarity and consistency.

Signed-off-by: Thomas Weißschuh 
Reviewed-by: Petr Pavlu 
Reviewed-by: Nicolas Schier 
Signed-off-by: Sami Tolvanen

module: Drop unused signature types

2026-03-24T21:42:37+00:00

Only PKCS#7 signatures are used today.

Remove the unused enum values. As this enum is used in on-disk data,
preserve the numeric value.

Signed-off-by: Thomas Weißschuh 
Reviewed-by: Petr Pavlu 
Reviewed-by: Nicolas Schier 
Signed-off-by: Sami Tolvanen

MODSIGN: make new include file self contained

2019-08-06T17:41:04+00:00

Fixes: c8424e776b09 ("MODSIGN: Export module signature definitions")
Signed-off-by: Stephen Rothwell 
Signed-off-by: Mimi Zohar

MODSIGN: Export module signature definitions

2019-08-05T22:39:56+00:00

IMA will use the module_signature format for append signatures, so export
the relevant definitions and factor out the code which verifies that the
appended signature trailer is valid.

Also, create a CONFIG_MODULE_SIG_FORMAT option so that IMA can select it
and be able to use mod_check_sig() without having to depend on either
CONFIG_MODULE_SIG or CONFIG_MODULES.

s390 duplicated the definition of struct module_signature so now they can
use the new  header instead.

Signed-off-by: Thiago Jung Bauermann 
Acked-by: Jessica Yu 
Reviewed-by: Philipp Rudo 
Cc: Heiko Carstens 
Signed-off-by: Mimi Zohar