linux-kernel - Re: [PATCH 21/21] MODSIGN: Apply signature checking to modules on module load [ver #3]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87mxazog9t.fsf@rustcorp.com.au>
Date:	Sun, 11 Dec 2011 15:29:10 +1030
From:	Rusty Russell <rusty@...abs.org>
To:	Arjan van de Ven <arjan@...radead.org>
Cc:	David Howells <dhowells@...hat.com>, keyrings@...ux-nfs.org,
	linux-crypto@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	linux-kernel@...r.kernel.org, dmitry.kasatkin@...el.com,
	zohar@...ux.vnet.ibm.com, arjan@...ux.intel.com,
	alan.cox@...el.com, Jon Masters <jcm@...masters.org>
Subject: Re: [PATCH 21/21] MODSIGN: Apply signature checking to modules on module load [ver #3]

On Sat, 10 Dec 2011 10:37:23 -0800, Arjan van de Ven <arjan@...radead.org> wrote:
> > 
> > Yes, there may be more than stripped and unstripped.  You may need to
> > do fancy things.  But now, adding a signature is so easy that it's
> > not a real problem.  And we can always have a hook, like:
> > 
> >         if VARIANTS=`make-module-variants $MOD`; then
> >                 for m in $VARIANTS; do sign $m >> $MOD; rm $m; done
> >         fi
> 
> but that requires you to keep the key around.

No, that's the point.  This was proposed as part of the kernel build.

make-module-variants does one or more transforms on the module
(eg. strip) and outputs the names of the results.  If they're not
reproducable, you have to keep them somewhere, yes, rather than remove
them as here.

> the most simple and common deployment of this is to generate a key,
> build the public key into the kernel, sign the modules as you build the
> kernel, and then destroy the key.
> And THEN it gets deployed.

Indeed.

You have to demonstrate why the simplest way won't work, before putting
450 lines of extra checking into the kernel.  Particularly since it's
supposed to protect against malicious modules, so I need to *really*
carefully review it.

Thanks,
Rusty.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/