Messages in this thread | | | Date | Tue, 8 Sep 2015 13:32:48 -0700 | Subject | Re: [GIT PULL] Security subsystem changes for 4.3 | From | Linus Torvalds <> |
| |
On Mon, Aug 31, 2015 at 5:00 PM, James Morris <jmorris@namei.org> wrote: > Highlights: > o PKCS#7 support added to support signed kexec, also utilized for module > signing.
So when testing this, I realized that when somebody tries to load a module with an invalid key, there doesn't seem to be any logs left about that.
I don't think this is new, it's just that the certificate generation changes made me test loading a module with the wrong cert, and while module loading itself failed gracefully and correctly with ENOKEY ("Required key not available"), I also ended up checking dmesg, because I - clearly incorrectly - thought that we'd warn the sysadmin about this too).
So I think that module loading failures due to lack of keys really should raise a few flags. Maybe the system is secure from some attacks, but you'd still want to know that somebody tried to do something fishy.
We *do* end up warning ("module verification failed") and tainting the kernel if we end up loading the module despite the key failing, but the situation I'm talking about is the "sig_enforce" case, which just causes a module loading failure with no system warning.
Linus
| |