linux-kernel - [PATCH -v2 0/7] module: Strict per-modname namespaces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241202145946.108093528@infradead.org>
Date: Mon, 02 Dec 2024 15:59:46 +0100
From: Peter Zijlstra <peterz@...radead.org>
To: mcgrof@...nel.org
Cc: x86@...nel.org,
 hpa@...or.com,
 petr.pavlu@...e.com,
 samitolvanen@...gle.com,
 da.gomez@...sung.com,
 masahiroy@...nel.org,
 nathan@...nel.org,
 nicolas@...sle.eu,
 linux-kernel@...r.kernel.org,
 linux-modules@...r.kernel.org,
 linux-kbuild@...r.kernel.org,
 hch@...radead.org,
 gregkh@...uxfoundation.org
Subject: [PATCH -v2 0/7] module: Strict per-modname namespaces

Hi!

Implement a means for exports to be available only to an explicit list of named
modules. By explicitly limiting the usage of certain exports, the abuse
potential/risk is greatly reduced.

The first 'patch' is an awk scripts that cleans up the existing module
namespace code along the same lines of commit 33def8498fdd ("treewide: Convert
macro and uses of __section(foo) to __section("foo")") and for the same reason,
it is not desired for the namespace argument to be a macro expansion itself.

The remainder of the patches introduce the special "MODULE_<modname-list>"
namespace, which shall be forbidden from being explicitly imported. A module
that matches the simple modname-list will get an implicit import.

Lightly tested with something like:

  git grep -l EXPORT_SYMBOL arch/x86/kvm/ | while read file;
  do
    sed -i -e 's/EXPORT_SYMBOL_GPL(\(.[^)]*\))/EXPORT_SYMBOL_GPL_FOR(\1, "kvm,kvm-intel,kvm-amd")/g' $file;
  done

With that, some configs generate:

  ERROR: modpost: module kvmgt uses symbol kvm_write_track_add_gfn from namespace MODULE_kvm,kvm-intel,kvm-amd, but does not import it.
  ERROR: modpost: module kvmgt uses symbol kvm_write_track_remove_gfn from namespace MODULE_kvm,kvm-intel,kvm-amd, but does not import it.
  ERROR: modpost: module kvmgt uses symbol kvm_page_track_register_notifier from namespace MODULE_kvm,kvm-intel,kvm-amd, but does not import it.
  ERROR: modpost: module kvmgt uses symbol kvm_page_track_unregister_notifier from namespace MODULE_kvm,kvm-intel,kvm-amd, but does not import it.

Showing it works :-). Also verified that once booted, the module kvm_intel does
actually load.

Also available at:

  git://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue.git module/namespace

Changes since RFC/v1:

 - use awk instead of sed so all changes are a single script (hch)
 - deal with kbuild mangling the module names like s/-/_/g (sean)
 - fixup clang-ias 'funnies'