linux-kernel - Re: [PATCH] power: disable hibernation if module loading is disabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201103051224.18621.rjw@sisk.pl>
Date:	Sat, 5 Mar 2011 12:24:18 +0100
From:	"Rafael J. Wysocki" <rjw@...k.pl>
To:	Vasiliy Kulikov <segoon@...nwall.com>
Cc:	linux-kernel@...r.kernel.org, security@...nel.org,
	Len Brown <len.brown@...el.com>, Pavel Machek <pavel@....cz>,
	linux-pm@...ts.linux-foundation.org
Subject: Re: [PATCH] power: disable hibernation if module loading is disabled

On Saturday, March 05, 2011, Vasiliy Kulikov wrote:
> On Fri, Mar 04, 2011 at 23:30 +0100, Rafael J. Wysocki wrote:
> > modules_disabled surely is not the right interface to disable hibernation
> > and I don't really think there's a bug because it doesn't work as you'd like
> > it to.  In fact, there would be a bug if it did work that way.
> 
> What do you mean here?  Do you agree that you may read kernel image,
> slightly change it (including e.g. possible checksums, I didn't bother
> to check how much one should change), and write it back?

Yes, you can, but that's not the point.  The point is that calling an interface
that disables all possible functionality modifying kernel memory
"modules_disabled" is completely dumb.  Sorry, but that's how it goes.

As I said before, if you want to have such an interface, call it properly
and introduce it along with documentation instead of changing an existing
one in a backwards-incopmatible fashion that in addition is totally
confusing.

Moreover, how are you going to protect your "protect kernel memory from
modification" interface itself from root access?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/