[lkml]   [2014]   [Nov]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH v3] crypto: prefix module autoloading with "crypto-"
On 21 November 2014 02:05, Kees Cook <> wrote:
> This prefixes all crypto module loading with "crypto-" so we never run
> the risk of exposing module auto-loading to userspace via a crypto API,
> as demonstrated by Mathias Krause:
> Signed-off-by: Kees Cook <>
> ---
> [...]

Looks good so far, but unfortunately does not solve the problem
completely (af_alg_mod from the link above):

bbox:~# cat /sbin/modlog
exec 1>/tmp/modlog.$$
echo "CMD: $0 $*"
echo "ENV: "
exec /sbin/modprobe "$@"
bbox:~# echo /sbin/modlog > /proc/sys/kernel/modprobe
bbox:~# lsmod | grep fat
bbox:~# af_alg_mod 'vfat(blowfish)'
bbox:~# grep CMD /tmp/modlog.*
/tmp/modlog.257:CMD: /sbin/modlog -q -- net-pf-38
/tmp/modlog.261:CMD: /sbin/modlog -q -- algif-hash
/tmp/modlog.265:CMD: /sbin/modlog -q -- crypto-vfat(blowfish)
/tmp/modlog.268:CMD: /sbin/modlog -q -- crypto-vfat(blowfish)-all
/tmp/modlog.272:CMD: /sbin/modlog -q -- vfat
bbox:~# lsmod | grep fat
vfat 17135 0
fat 61984 1 vfat

The last modlog call does not contain the "crypto-" prefix, therefore
happily loads the vfat module.
I guess crypto templates are handled special?


 \ /
  Last update: 2014-11-21 10:01    [W:0.096 / U:6.100 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site