linux-kernel - Re: lve module taint?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 19 Sep 2012 08:19:42 +0100
From:	Greg KH <gregkh@...uxfoundation.org>
To:	Michael Tokarev <mjt@....msk.ru>
Cc:	Rusty Russell <rusty@...tcorp.com.au>,
	Matthew Garrett <mjg59@...f.ucam.org>,
	Alex Lyashkov <umka@...udlinux.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: lve module taint?

On Wed, Sep 19, 2012 at 09:58:09AM +0400, Michael Tokarev wrote:
> On 19.09.2012 06:02, Rusty Russell wrote:
> 
> > From:	Matthew Garrett <mjg59@...f.ucam.org>
> > Subject: module: taint kernel when lve module is loaded
> > Date: Fri, 22 Jun 2012 13:49:31 -0400
> > 
> > Cloudlinux have a product called lve that includes a kernel module. This
> > was previously GPLed but is now under a proprietary license, but the
> > module continues to declare MODULE_LICENSE("GPL") and makes use of some
> > EXPORT_SYMBOL_GPL symbols. Forcibly taint it in order to avoid this.
> 
> > +	/* lve claims to be GPL but upstream won't provide source */
> > +	if (strcmp(mod->name, "lve") == 0)
> > +		add_taint_module(mod, TAINT_PROPRIETARY_MODULE);
> 
> This is setting a, in my opinion, rather bad precedent.  Next we'll
> be adding various modules here due to various reasons.
> 
> I think this case should be pure political now, not technical.  Ie,
> if some project declares itself as GPL, it is not kernel task to
> verify that the sources are available or to enforce that.

But when such code is known to lie, we have the responsibility to
enforce it, right?  We already do this for other module, it's not the
first time, and hopefully we will not have to continue extending this
"blacklist" to more modules, but real-world experience tends to make me
thing otherwise :(

Rusty, no objection from me for the patch.

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/