linux-kernel - [PATCH] Allow automatic kernel taint on unsigned module load to be disabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170804180751.14896-1-mjg59@google.com>
Date:   Fri,  4 Aug 2017 11:07:51 -0700
From:   Matthew Garrett <mjg59@...gle.com>
To:     linux-kernel@...r.kernel.org
Cc:     jeyu@...nel.org, rusty@...tcorp.com.au,
        Matthew Garrett <mjg59@...gle.com>
Subject: [PATCH] Allow automatic kernel taint on unsigned module load to be disabled

Distributions may wish to provide kernels that permit loading of
unsigned modules based on certain policy decisions. Right now that
results in the kernel being tainted whenever an unsigned module is
loaded, which may not be desirable. Add a config option to disable that.

Signed-off-by: Matthew Garrett <mjg59@...gle.com>
---
 init/Kconfig    | 13 ++++++++++++-
 kernel/module.c |  2 ++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/init/Kconfig b/init/Kconfig
index 8514b25db21c..196860c5d1e5 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1749,12 +1749,23 @@ config MODULE_SIG
 	  debuginfo strip done by some packagers (such as rpmbuild) and
 	  inclusion into an initramfs that wants the module size reduced.
 
+config MODULE_UNSIGNED_TAINT
+	bool "Taint the kernel if unsigned modules are loaded"
+	default y
+	depends on MODULE_SIG
+	help
+	  Taint the kernel if an unsigned kernel module is loaded. If this
+	  option is enabled, the kernel will be tainted on an attempt to load
+	  an unsigned module or signed modules for which we don't have a key
+	  even if signature enforcement is disabled.
+
 config MODULE_SIG_FORCE
 	bool "Require modules to be validly signed"
 	depends on MODULE_SIG
 	help
 	  Reject unsigned modules or signed modules for which we don't have a
-	  key.  Without this, such modules will simply taint the kernel.
+	  key. Without this, such modules will be loaded successfully but will
+	  (if MODULE_UNSIGNED_TAINT is set) taint the kernel.
 
 config MODULE_SIG_ALL
 	bool "Automatically sign all modules"
diff --git a/kernel/module.c b/kernel/module.c
index 40f983cbea81..71f80c8816f2 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3660,12 +3660,14 @@ static int load_module(struct load_info *info, const char __user *uargs,
 
 #ifdef CONFIG_MODULE_SIG
 	mod->sig_ok = info->sig_ok;
+#ifdef CONFIG_MODULE_UNSIGNED_TAINT
 	if (!mod->sig_ok) {
 		pr_notice_once("%s: module verification failed: signature "
 			       "and/or required key missing - tainting "
 			       "kernel\n", mod->name);
 		add_taint_module(mod, TAINT_UNSIGNED_MODULE, LOCKDEP_STILL_OK);
 	}
+#endif
 #endif
 
 	/* To avoid stressing percpu allocator, do this once we're unique. */
-- 
2.14.0.rc1.383.gd1ce394fe2-goog