[lkml]   [2004]   [Oct]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Fw: signed kernel modules?
    On Tue, 2004-10-12 at 08:34 +1000, Rusty Russell (IBM) wrote:
    > Welcome to the debate David. I agree that you only need to sign the
    > things that the kernel looks at, unfortunately, there's not a nice clear
    > line: for example the headers change when you strip the module, and they
    > need to be signed.

    First you agree that we only need to sign the things the kernel looks
    at, but then you seem to be saying we need to sign _all_ of the headers.
    That isn't consistent, surely?

    Think of it as canonicalising the module before we sign it.
    Conceptually, we strip the module and make a signature on the bits which
    are actually _relevant_, not on the fluff. It's just that we want to do
    what while being able to leave the debug information and all the
    irrelevant symbols etc. in place in the object file.

    We know _precisely_ what the kernel looks at -- we wrote its linker. It
    really isn't that hard.

    > Trying to work around it just gets you into more and more complexity:
    > you can't trust the module until you've checked the signature, and when
    > you don't trust the module you have to write paranoid code, which is
    > very ugly and causes bloat. David Howells just sidestepped this and
    > trusted the module headers, and so I refused his patch.

    If there's something specific which he wasn't checking which could
    actually make a _real_ difference to the module once it's loaded and
    linked, please point it out.

    Trusting _just_ the headers doesn't seem to make sense, I agree --
    surely you actually want to include the contents of the text and data
    sections in your signature? Are you saying David didn't do that? That
    would want fixing, obviously. But it doesn't mean that we should be
    signing the _whole_ of the object file, irrelevant parts and all.

    > Nor do I have to re-iterate the points from the discussion for someone
    > who hasn't bothered reading it. But I did.

    Sorry, I didn't think the discussion had been in public. While I'm sure
    I _could_ read mail in David's inbox, I feel it would be somewhat
    impolite. It's not that I "haven't bothered". :)


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:06    [W:0.020 / U:194.404 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site