linux-kernel - Re: [PATCH] Add kernel parameter to blacklist modules

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160614205134.GA16214@khazad-dum.debian.net>
Date:	Tue, 14 Jun 2016 17:51:34 -0300
From:	Henrique de Moraes Holschuh <hmh@....eng.br>
To:	Christoph Hellwig <hch@...radead.org>
Cc:	Prarit Bhargava <prarit@...hat.com>, linux-kernel@...r.kernel.org,
	Jonathan Corbet <corbet@....net>,
	Rusty Russell <rusty@...tcorp.com.au>,
	linux-doc@...r.kernel.org
Subject: Re: [PATCH] Add kernel parameter to blacklist modules

On Tue, 14 Jun 2016, Christoph Hellwig wrote:
> On Mon, Jun 13, 2016 at 08:32:41AM -0400, Prarit Bhargava wrote:
> > Blacklisting a module in linux has long been a problem.  The process of
> > blacklisting a module has changed over time, and it seems that every OS
> > does it slightly differently and depends on the age of the init system
> > used on that OS.
> 
> And why would we care about blacklisting a module?

Because the "Current Best Practice" way to help users blacklist modules
that won't drag you to nasty places trying to ensure they did it right
(i.e. "mv" the .ko file away then trigger an initramfs update and
reboot) just covers situations where the system actually boots/installs
mostly fine in the first place.

So, yes, such a feature looks like it would be rather useful, to the
point that I'd even advocate for it to be backported (once it has been
in a released mainline kernel for a while to remove any risk of
regressions, of course).

And if such a module blacklist feature ends up being invoked by the
"nuke_module_from_orbit=<modules list>" parameter, I will pay the author
(and the subsystem maintainer that manages to get that merged) a couple
beers should we ever meet in real life :-)

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh