linux-kernel - Re: [PATCH v9 10/10] docs: Include modules.builtin.alias

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 19 Dec 2022 15:40:42 -0600
From:   Allen Webb <allenwebb@...gle.com>
To:     Luis Chamberlain <mcgrof@...nel.org>
Cc:     "linux-modules@...r.kernel.org" <linux-modules@...r.kernel.org>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Rafael J. Wysocki" <rafael@...nel.org>
Subject: Re: [PATCH v9 10/10] docs: Include modules.builtin.alias

On Mon, Dec 19, 2022 at 3:23 PM Luis Chamberlain <mcgrof@...nel.org> wrote:
>
> On Mon, Dec 19, 2022 at 02:46:18PM -0600, Allen Webb wrote:
> > Update the documentation to include the presense and use case of
> > modules.builtin.alias.
> >
> > Signed-off-by: Allen Webb <allenwebb@...gle.com>
> > ---
> >  Documentation/kbuild/kbuild.rst | 6 ++++++
> >  1 file changed, 6 insertions(+)
> >
> > diff --git a/Documentation/kbuild/kbuild.rst b/Documentation/kbuild/kbuild.rst
> > index 08f575e6236c..1c7c02040a54 100644
> > --- a/Documentation/kbuild/kbuild.rst
> > +++ b/Documentation/kbuild/kbuild.rst
> > @@ -17,6 +17,12 @@ modules.builtin
> >  This file lists all modules that are built into the kernel. This is used
> >  by modprobe to not fail when trying to load something builtin.
> >
> > +modules.builtin.alias
> > +---------------------
> > +This file lists all match-id based aliases for modules built into the kernel.
> > +These are intended to enable userspace to make authorization decisions based
> > +on which modules are likely to be bound to a device after it is authorized.
>
> What is an example? This sounds obscure.

Many of the devices that match the usb_storage driver only specify the
vendor id, product id, and device id (VID:PID:D) and do not match
against device class, interface class, etc. Here are some examples
from modules.alias: A grep for wildcards in these fields yields 6136
matches:
grep 'dc\*dsc\*dp\*ic\*isc\*ip\*in\*'
/lib/modules/5.19.11-1rodete1-amd64/modules.alias | wc -l
6136

To write USBGuard policy that only authorizes devices that bind to a
particular module the policy needs to be aware of all these VID:PID:D
which can change between kernel versions.

This is done at runtime rather than excluding modules from the build
because some devices are not needed at or before login or when a
device is locked. By not authorizing new devices that would bind to a
set of modules, these modules become unreachable to an attacker who
seeks to exploit kernel bugs in those modules.

I could add this detail to the documentation file, but I was trying to
keep the description to about the same length as the others around it.

>
>   Luis