linux-kernel - Re: [PATCH V2] Allow configuring whether unsigned modules taint the kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACdnJus8ukCH_GutjNJpN2qHD1k6FvmeOqO69E27SqL3y_hf-Q@mail.gmail.com>
Date:   Tue, 27 Feb 2018 21:14:41 +0000
From:   Matthew Garrett <mjg59@...gle.com>
To:     jeyu@...hat.com
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH V2] Allow configuring whether unsigned modules taint the kernel

On Tue, Feb 20, 2018 at 2:51 PM Matthew Garrett <mjg59@...gle.com> wrote:

> Distributions build kernels that are intended to satisfy multiple
> use-cases. One is that kernels must be usable in scenarios where module
> signing is required (such as many Secure Boot policies) and scenarios
> where it isn't (such as booting the same kernel on a legacy BIOS
> system). This requires that CONFIG_MODULE_SIG be set, but this causes a
> change in behaviour for the legacy platform case - loading an unsigned
> module now taints the kernel. This is a change in behaviour, and may
> cause users to file bugs, increasing distribution support load.

Sorry, just realised I sent the wrong version of this - I'll resend.