lkml.org 
[lkml]   [2017]   [Apr]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH 5/6] MODSIGN: Export module signature definitions.
Date
Am Donnerstag, 20. April 2017, 15:37:37 BRT schrieb David Howells:
> Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> > On Tue, 2017-04-18 at 17:17 -0300, Thiago Jung Bauermann wrote:
> > > IMA will use the module_signature format for append signatures, so
> > > export
> > > the relevant definitions and factor out the code which verifies that the
> > > appended signature trailer is valid.
> > >
> > > Also, create a CONFIG_MODULE_SIG_FORMAT option so that IMA can select it
> > > and be able to use validate_module_signature without having to depend on
> > > CONFIG_MODULE_SIG.
> >
> > Basically we want to generalize the concept of an appended signature.
> > Referring to it as a "module signature format" seems a bit confusing.
> >
> > David, would you have a problem with changing the appended string from
> > "~Module signature appended~\n" to something more generic?
>
> Conceptually, no. Is it possible that doing so could break someone's module
> that they load on multiple versions of the kernel? Say a module that only
> exports things and doesn't use anything from the core or any other module.

I think that changing the appended string has limited value because very few
people actually see them. It's just a marker. We could s/module_signature/
appended_signature/ in the code but keep the actual string unchanged. What do
you think?

Alternatively, we could change the string but accept both the old and the new
string for backwards compatibility.

--
Thiago Jung Bauermann
IBM Linux Technology Center

\
 
 \ /
  Last update: 2017-04-20 23:08    [W:0.062 / U:1.144 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site