linux-kernel - Re: [PATCH kmod v5 5/5] libkmod, depmod, modprobe: Make directory for kernel modules configurable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 9 Nov 2023 18:40:34 +0100
From:   Michal Suchánek <msuchanek@...e.de>
To:     Jan Engelhardt <jengelh@...i.de>
Cc:     Lucas De Marchi <lucas.demarchi@...el.com>,
        linux-modules@...r.kernel.org, Takashi Iwai <tiwai@...e.com>,
        Lucas De Marchi <lucas.de.marchi@...il.com>,
        Michal Koutný <mkoutny@...e.com>,
        Jiri Slaby <jslaby@...e.com>,
        Masahiro Yamada <masahiroy@...nel.org>,
        Nathan Chancellor <nathan@...nel.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Nicolas Schier <nicolas@...sle.eu>,
        linux-kbuild@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH kmod v5 5/5] libkmod, depmod, modprobe: Make directory
 for kernel modules configurable

On Wed, Oct 18, 2023 at 03:25:19AM +0200, Jan Engelhardt wrote:
> On Tuesday 2023-10-17 19:50, Lucas De Marchi wrote:
> >> +AC_ARG_WITH([module_directory],
> >> +        AS_HELP_STRING([--with-module-directory=DIR], [directory in which to
> >> look for kernel modules - typically '/lib/modules' or
> >> '${prefix}/lib/modules']),
> >> +        [], [with_module_directory=/lib/modules])
> >> +AC_SUBST([module_directory], [$with_module_directory])
> >
> > we will probably have "fun" results if we accept a relative path here.
> 
> $ ./configure --prefix=/usr --bindir=../bin
> configure: error: expected an absolute directory name for --bindir: ../bin
> 
> While such check does not exist for --with-module-directory, everyone
> has likely been well-trained not to use relative paths. Even if, say,
> cmake/meson *could* do it, it just would have never occurred to me to
> actually *utilize* it, because it is just too ambiguous and
> potentially dangerous.
> 
> Just think of all the fun you could have with LD_LIBRARY_PATH=".."

Is there an example of how this guarding against relative paths is done
in other options that accept directories?

There may be something for the built-in options but the existing custom
rootlibdir option does not seem to have anything either.

Thanks

Michal