lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 24 Oct 2012 13:36:59 +1030 From: Rusty Russell <rusty@...tcorp.com.au> To: Lucas De Marchi <lucas.demarchi@...fusion.mobi>, Kees Cook <keescook@...omium.org> Cc: mtk.manpages@...il.com, "H. Peter Anvin" <hpa@...or.com>, linux-kernel@...r.kernel.org, jonathon@...masters.org, "Mimi Zohar" <zohar@...ux.vnet.ibm.com>, "Kasatkin\, Dmitry" <dmitry.kasatkin@...el.com> Subject: Re: [PATCH 1/4] module: add syscall to load module from fd Lucas De Marchi <lucas.demarchi@...fusion.mobi> writes: > On Tue, Oct 23, 2012 at 1:42 PM, Kees Cook <keescook@...omium.org> wrote: >> On Mon, Oct 22, 2012 at 9:08 PM, Lucas De Marchi >> <lucas.demarchi@...fusion.mobi> wrote: >>> sure... but do you realize this will fail in case kernel is checking >>> module signature and we passed --force to modprobe (therefore mangled >>> the decompressed memory area)? >> >> Hm, yeah, userspace mangling of a module plus signing would fail. >> Seems like mangling and signing aren't compatible. Doing it in >> kernel-space (as now written for finit_module) solves that, but it >> means that now compression isn't possible if you need both signing and >> mangling. Signing and mangling are always incompatible, of course. Compressed modules breaks Kees' (and IMA's) requirement to have an fd attached, unless the kernel does the decompression. We have that code already, in fact. It would be easy to add a config option the recognize the compression magic and uncompress in-kernel. That would happen after the signature check, of course, and Just Work. Cheers, Rusty. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists