linux-kernel - Re: [PATCH 0/6] MODSIGN: Kernel module signing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 15 Feb 2007 22:01:40 +0100 (CET)
From:	Roman Zippel <zippel@...ux-m68k.org>
To:	David Lang <david.lang@...italinsight.com>
cc:	David Howells <dhowells@...hat.com>, torvalds@...l.org,
	akpm@...l.org, herbert.xu@...hat.com, linux-kernel@...r.kernel.org,
	davej@...hat.com, arjan@...radead.org, linux-crypto@...r.kernel.org
Subject: Re: [PATCH 0/6] MODSIGN: Kernel module signing 

Hi,

On Thu, 15 Feb 2007, David Lang wrote:

> this issue, and these holes keep comeing up in discussions, why can't these
> holes be closed? I seem to remember seeing patches that would remove /dev/kmem
> being sent to the list, but they weren't accepted into the kernel (and I seem
> to remember people being against the concept of removeing them, not against
> techincal details of the patches. but this was many years ago)

1. It depends on the ratio of added code and its usefulness. I must assume 
the first patch didn't even make it to the kernel due to its size, so I 
think it's not unreasonable to explore the alternatives.
2. There are many ways to load an unauthorized module, thus you have to 
prevent any modification of the kernel not just in memory but also on 
disk.

bye, Roman
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/