Specify the hash to use when signing modules
An XCCDF Rule
Description
This configures the kernel to build and sign modules using
/boot/config-*.
To check the configuration value for CONFIG_MODULE_SIG_HASH, run the following command:
grep CONFIG_MODULE_SIG_HASH /boot/config-*
For each kernel installed, a line with value "
warning alert: Warning
There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.
Rationale
Use of strong hash function is important to secure the module against counterfeit signatures.
- ID
- xccdf_org.ssgproject.content_rule_kernel_config_module_sig_hash
- Severity
- Medium
- References
- Updated