lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 10 Sep 2012 08:07:03 -0700 From: Kees Cook <keescook@...omium.org> To: Rusty Russell <rusty@...tcorp.com.au> Cc: Mimi Zohar <zohar@...ux.vnet.ibm.com>, linux-kernel@...r.kernel.org, Serge Hallyn <serge.hallyn@...onical.com>, James Morris <james.l.morris@...cle.com>, Al Viro <viro@...iv.linux.org.uk>, Eric Paris <eparis@...hat.com>, Jiri Kosina <jkosina@...e.cz>, linux-security-module@...r.kernel.org, Chris Wright <chrisw@...s-sol.org> Subject: Re: [PATCH 1/2] module: add syscall to load module from fd On Sun, Sep 9, 2012 at 6:46 PM, Rusty Russell <rusty@...tcorp.com.au> wrote: > Kees Cook <keescook@...omium.org> writes: >> On Fri, Sep 7, 2012 at 10:12 AM, Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote: >>> This method is a consistent and extensible approach to verifying the >>> integrity of file data/metadata, including kernel modules. The only >>> downside to this approach, I think, is that it requires changes to the >>> userspace tool. >> >> I'm fine with this -- it's an expected change that I'll pursue with >> glibc, kmod, etc. Without the userspace changes, nothing will use the >> new syscall. :) I've already got kmod (and older module-init-tools) >> patched to do this locally. > > A syscall is the right way to do this. But does it need to be done? > > 1) Do the LSM guys really want this hook? The LSM hook half has already been acked by Serge and Eric, and I want to use it in Yama as well. > 2) Do we have a userspace which uses it? Chrome OS will be using it; I have patches for kmod and module-init-tools already. > If yes to both, and noone comes up with any creative complaints, I will > take the patch. Sound good; thanks! -Kees -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists