linux-kernel - Re: [PATCH v5 07/13] module: Move extra signature support out of core code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8b7988be-488e-f570-b499-5892c57f5e04@csgroup.eu>
Date:   Thu, 10 Feb 2022 13:01:40 +0000
From:   Christophe Leroy <christophe.leroy@...roup.eu>
To:     "20220209170358.3266629-1-atomlin@...hat.com" 
        <20220209170358.3266629-1-atomlin@...hat.com>,
        "mcgrof@...nel.org" <mcgrof@...nel.org>,
        Aaron Tomlin <atomlin@...hat.com>
CC:     "cl@...ux.com" <cl@...ux.com>,
        "pmladek@...e.com" <pmladek@...e.com>,
        "mbenes@...e.cz" <mbenes@...e.cz>,
        "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "jeyu@...nel.org" <jeyu@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-modules@...r.kernel.org" <linux-modules@...r.kernel.org>,
        "live-patching@...r.kernel.org" <live-patching@...r.kernel.org>,
        "atomlin@...mlin.com" <atomlin@...mlin.com>,
        "ghalat@...hat.com" <ghalat@...hat.com>,
        "allen.lkml@...il.com" <allen.lkml@...il.com>,
        "void@...ifault.com" <void@...ifault.com>,
        "joe@...ches.com" <joe@...ches.com>,
        "msuchanek@...e.de" <msuchanek@...e.de>,
        "oleksandr@...alenko.name" <oleksandr@...alenko.name>
Subject: Re: [PATCH v5 07/13] module: Move extra signature support out of core
 code

Why do patches 7 to 13 have a Reply-to: 
20220209170358.3266629-1-atomlin@...hat.com and not patches 1 to 6 ?

Le 09/02/2022 à 18:08, Aaron Tomlin a écrit :
> No functional change.
> 
> This patch migrates additional module signature check
> code from core module code into kernel/module/signing.c.
> 
> Signed-off-by: Aaron Tomlin <atomlin@...hat.com>
> ---
>   include/linux/module.h   |  1 +
>   kernel/module/internal.h |  9 +++++
>   kernel/module/main.c     | 87 ----------------------------------------
>   kernel/module/signing.c  | 75 ++++++++++++++++++++++++++++++++++
>   4 files changed, 85 insertions(+), 87 deletions(-)
> 
> diff --git a/include/linux/module.h b/include/linux/module.h
> index fd6161d78127..aea0ffd94a41 100644
> --- a/include/linux/module.h
> +++ b/include/linux/module.h
> @@ -863,6 +863,7 @@ static inline bool module_sig_ok(struct module *module)
>   {
>   	return true;
>   }
> +#define sig_enforce false

Having that is module.h  it may redefine some existing symbol, like in 
security/integrity/ima/ima_main.c

sig_enforce is used only in signing.c so it should be defined there 
exclusively. This #define shouldn't be needed at all.



And checkpatch is not happy:

CHECK: Please use a blank line after function/struct/union/enum declarations
#27: FILE: include/linux/module.h:866:
  }
+#define sig_enforce false


>   #endif	/* CONFIG_MODULE_SIG */
>   
>   int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *,