Messages in this thread | | | Subject | Re: [RFC] LSM changes for 2.5.38 | From | Alan Cox <> | Date | 30 Sep 2002 15:51:11 +0100 |
| |
On Mon, 2002-09-30 at 15:19, Valdis.Kletnieks@vt.edu wrote: > On Fri, 27 Sep 2002 19:59:19 BST, Christoph Hellwig said: > > > insmod doesn't require modules to be in /lib/modules. > > This would probably be closed by this code in sys_create_module(): > > /* check that we have permission to do this */ > error = security_ops->module_ops->create_module(name, size); > if (error) > goto err1;
This is part of the problem as ever. The name that is used is meaningless. The module loader needs to make meaningful decisions. That really means it needs to be able to see the actual loaded module. If we go to Rusty's kernel module loader then we can fix this because we can pass the actual module code/data block and sizes to the LSM. At that point the LSM can do meaningful things like GPG.
In the current form you can say that module creation can only be done by the right kind of user, and the program "insmod", but even in this case the module name fed to the LSM seems worthless
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |