linux-kernel - Re: changeset: Make forced module loading optional

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 4 May 2008 22:05:51 -0700 (PDT)
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Rusty Russell <rusty@...tcorp.com.au>
cc:	linux-kernel@...r.kernel.org,
	Jon Masters <jonathan@...masters.org>,
	Sam Ravnborg <sam@...nborg.org>
Subject: Re: changeset: Make forced module loading optional

On Mon, 5 May 2008, Rusty Russell wrote:
> 
>    I'm trying to figure out how you did this.  So fedora builds unversioned 
> modules, and version (and vermagic) matched your kernel?  And you somehow 
> mixed them up?

I don't use modules much, so many of my kernels tend to have modules off 
entirely. However, the Intel wireless drivers used to not work when 
built-in (fixed now, but I still had a legacy config), so my laptop had 
modules enabled, and MODVERSIONS set.

And I don't build initrd's etc crap, very much on purpose. I want to 
replace the kernel, nothing else, so my /etc/grub.conf file just replaces 
the distro kernel with my own, and keeps everything else untouched.

>    I don't think relying on modversions is the complete answer here.  Perhaps 
> we should make modules_install blow away old modules?

Wouldn't help one whit, and is against my rules anyway. See above. I want 
my own kernel, no other changes. That means that I run the distro initrd, 
which has its modules for bringing stuff up with distro kernels.

And quite frankly, when I finally figured out what was going on, I was 
like *WHAT THE HELL*. That kernel/module.c code was absolute and utter 
crap in accepting modules that neither matched the kernel version 
signature (because it had CONFIG_MODVERSIONS) *nor* the actual versioned 
symbols (because the distro modules had been built without 
CONFIG_MODVERSIONS).

So no, I'm not at all interested in blowing away old modules. I'm 
interested in having a module loader that isn't complete and utter crap 
and bypasses all the sanity checks that it has.

Which is what that changeset basically does.

People can still set CONFIG_MODULE_LOAD_FORCE, but quite frankly, I 
suspect that anybody who does that is just insane and/or works with 
proprietary and broken modules. So it's off by default, and hopefully no 
distro will ever set it.

			Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/