From 7b59c6d03248b9dfcf27d4477f0c579143612ffd Mon Sep 17 00:00:00 2001
From: Peter Kolínek <fedora@pessoft.com>
Date: Feb 21 2018 23:52:41 +0000
Subject: [PATCH 1/3] Fix keyring name used by modsign test to detect module signing


This fix will enable modsign test again on Fedora 27 to some degree.
---

diff --git a/default/modsign/modsign_tests.sh b/default/modsign/modsign_tests.sh
index 750e045..54a365e 100755
--- a/default/modsign/modsign_tests.sh
+++ b/default/modsign/modsign_tests.sh
@@ -110,13 +110,13 @@ modsign_third_party()
 modsign=0
 if [ -f /proc/keys ]
 then
-	cat /proc/keys | grep system_keyring &> /dev/null
+	cat /proc/keys | grep builtin_trusted_keys &> /dev/null
 	if [ $? -ne "0" ]
 	then
 		echo Module signing not enabled
 		exit 3
 	fi
-	keyring=`cat /proc/keys | grep system_keyring | cut -f 1 -d " "`
+	keyring=`cat /proc/keys | grep builtin_trusted_keys | cut -f 1 -d " "`
 	keyctl list 0x${keyring} | grep "Fedora kernel signing key" &> /dev/null
 	if [ $? == "0" ]
 	then

From 6520d10f3af1d22d8ad48fd46b6bf6c6da3fa250 Mon Sep 17 00:00:00 2001
From: Peter Kolínek <fedora@pessoft.com>
Date: Feb 22 2018 08:38:00 +0000
Subject: [PATCH 2/3] Fix modsign_unsigned and enforcing for SecureBoot


Some fixes related mainly to modsign_unsigned() test:
- Correct message on failed load of unsigned module in enforcing mode
- Fix return variable to fail, instead pass
- Add secureboot compatibility, where if secureboot is enabled, kernel should prevent unsigned modules regardless of sig_enforce value.
---

diff --git a/default/modsign/modsign_tests.sh b/default/modsign/modsign_tests.sh
index 54a365e..c18e3fb 100755
--- a/default/modsign/modsign_tests.sh
+++ b/default/modsign/modsign_tests.sh
@@ -87,7 +87,7 @@ modsign_unsigned()
 	else
 		if [ ${loaded} -ne "0" ]
 		then
-			echo "Successfully enforced signed module"
+			echo "Unsigned module load failed in enforcing mode"
 		else
 			echo "Unsigned module loaded in enforcing mode"
 			rmmod minix
@@ -98,7 +98,7 @@ modsign_unsigned()
 	# cleanup
 	rm ./minix.ko
 
-	return ${pass}
+	return ${fail}
 }			
 
 modsign_third_party()
@@ -139,6 +139,14 @@ fi
 
 enforcing=`cat /sys/module/module/parameters/sig_enforce`
 
+# SecureBoot should enforce requirement of valid module signatures regardless of sig_enforce.
+# Check that SecureBoot is enabled in EFI variables
+secureboot=`od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-* | awk ' { print $5 } '`
+if [ "$secureboot" == "1" ]
+then
+        enforcing="Y"
+fi
+
 # Make sure we actually have signed modules and that they load
 modsign_check_modules
 

From 0624a31fca47caced1a4bfd6e3389d8a3f9a234d Mon Sep 17 00:00:00 2001
From: Peter Kolínek <fedora@pessoft.com>
Date: Feb 23 2018 16:38:43 +0000
Subject: [PATCH 3/3] No error output for modsign test SecureBoot detection


---

diff --git a/default/modsign/modsign_tests.sh b/default/modsign/modsign_tests.sh
index c18e3fb..c541ade 100755
--- a/default/modsign/modsign_tests.sh
+++ b/default/modsign/modsign_tests.sh
@@ -141,7 +141,7 @@ enforcing=`cat /sys/module/module/parameters/sig_enforce`
 
 # SecureBoot should enforce requirement of valid module signatures regardless of sig_enforce.
 # Check that SecureBoot is enabled in EFI variables
-secureboot=`od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-* | awk ' { print $5 } '`
+secureboot=`od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-* 2>/dev/null | awk ' { print $5 } '`
 if [ "$secureboot" == "1" ]
 then
         enforcing="Y"