linux-kernel - Re: [PATCH] fs: export anon_inode_make_secure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aFljQTbXXXHG1E6f@infradead.org>
Date: Mon, 23 Jun 2025 07:22:57 -0700
From: Christoph Hellwig <hch@...radead.org>
To: Vlastimil Babka <vbabka@...e.cz>
Cc: Christoph Hellwig <hch@...radead.org>,
	Christian Brauner <brauner@...nel.org>,
	Sean Christopherson <seanjc@...gle.com>,
	Mike Rapoport <rppt@...nel.org>, Shivank Garg <shivankg@....com>,
	david@...hat.com, akpm@...ux-foundation.org, paul@...l-moore.com,
	viro@...iv.linux.org.uk, willy@...radead.org, pbonzini@...hat.com,
	tabba@...gle.com, afranji@...gle.com, ackerleytng@...gle.com,
	jack@...e.cz, cgzones@...glemail.com, ira.weiny@...el.com,
	roypat@...zon.co.uk, linux-fsdevel@...r.kernel.org,
	linux-mm@...ck.org, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	Peter Zijlstra <peterz@...radead.org>
Subject: Re: [PATCH] fs: export anon_inode_make_secure_inode() and fix
 secretmem LSM bypass

On Mon, Jun 23, 2025 at 04:21:15PM +0200, Vlastimil Babka wrote:
> On 6/23/25 16:01, Christoph Hellwig wrote:
> > On Mon, Jun 23, 2025 at 07:00:39AM -0700, Christoph Hellwig wrote:
> >> On Mon, Jun 23, 2025 at 12:16:27PM +0200, Christian Brauner wrote:
> >> > I'm more than happy to switch a bunch of our exports so that we only
> >> > allow them for specific modules. But for that we also need
> >> > EXPOR_SYMBOL_FOR_MODULES() so we can switch our non-gpl versions.
> >> 
> >> Huh?  Any export for a specific in-tree module (or set thereof) is
> >> by definition internals and an _GPL export if perfectly fine and
> >> expected.
> 
> Peterz tells me EXPORT_SYMBOL_GPL_FOR_MODULES() is not limited to in-tree
> modules, so external module with GPL and matching name can import.

Sure, technically they can.  But that's not the intent of the export,
but rather abusing it.