Messages in this thread | | | Subject | Re: [PULL] modules-next | From | Ben Hutchings <> | Date | Mon, 01 Aug 2016 20:11:27 +0100 |
| |
On Sun, 2016-07-31 at 21:44 -0400, Linus Torvalds wrote: > So this feels wrong to me, can you guys please explain: > > On Sun, Jul 31, 2016 at 9:02 PM, Rusty Russell <rusty@rustcorp.com.au> wrote: > > > > Ben Hutchings (3): > > module: Invalidate signatures on force-loaded modules > > module: Disable MODULE_FORCE_LOAD when MODULE_SIG_FORCE is enabled > > forcing a load and SIG_FORCE are entirely independent issues, afaik. I > think requiring signed modules is just a good idea. But that doesn't > necessarily mean that you don't have a signed module that is signed > with a key you trust, but you still want to force-load it for the > wrong kernel version (ie maybe you have a binary-only module from your > IT department (and your IT department is evil,but at least they sign > it to show that the module is trust-worthy as coming from them, even > if they have some dubious behavior), but you did some kernel updates > that still allow the module to work but the version doesn't match any > more).
We discussed this before and I thought you were happy with this version. If the use case you describe is at all common, it could perhaps be handled by having a tool that patches the version information and re-signs the module with a different trusted key.
> Am I missing something? What's the connection between > MODULE_FORCE_LOAD and MODULE_SIG_FORCE? Because it smells like they > are independent and that the above changes are very very dubious.
As I understand it: - module signature enforcement means that root is not trusted to load arbitrary code into the kernel; instead the code has to be approved by one of the signing key holders - force-loading a module means "I promise that this module is ABI compatible, even though it doesn't appear to be"
No-one signs that promise, and if it's false, the ABI differences could mean that an otherwise benign module would compromise the kernel. So as I see it, the kernel should not trust a force-loaded signed module any more than an unsigned module.
If you still think that module signature enforcement is compatible with force-loading, I would like to know what you consider the purpose of enforcement to be.
Ben.
> I didn't actually pull the tree, I just reacted to the pull request itself. > > Linus --
Ben Hutchings Sturgeon's Law: Ninety percent of everything is crap. [unhandled content-type:application/pgp-signature] | |