Messages in this thread | | | From | Rusty Russell <> | Subject | Re: [PATCH 1/4] module: add syscall to load module from fd | Date | Wed, 24 Oct 2012 13:36:59 +1030 |
| |
Lucas De Marchi <lucas.demarchi@profusion.mobi> writes: > On Tue, Oct 23, 2012 at 1:42 PM, Kees Cook <keescook@chromium.org> wrote: >> On Mon, Oct 22, 2012 at 9:08 PM, Lucas De Marchi >> <lucas.demarchi@profusion.mobi> wrote: >>> sure... but do you realize this will fail in case kernel is checking >>> module signature and we passed --force to modprobe (therefore mangled >>> the decompressed memory area)? >> >> Hm, yeah, userspace mangling of a module plus signing would fail. >> Seems like mangling and signing aren't compatible. Doing it in >> kernel-space (as now written for finit_module) solves that, but it >> means that now compression isn't possible if you need both signing and >> mangling.
Signing and mangling are always incompatible, of course.
Compressed modules breaks Kees' (and IMA's) requirement to have an fd attached, unless the kernel does the decompression. We have that code already, in fact.
It would be easy to add a config option the recognize the compression magic and uncompress in-kernel. That would happen after the signature check, of course, and Just Work.
Cheers, Rusty.
| |