linux-kernel - Re: [PATCH 1/2] module: Restrict module namespace access to in-tree modules

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <39bed180-e21c-4801-8ac4-ba40b57f6df2@suse.cz>
Date: Tue, 8 Jul 2025 17:08:45 +0200
From: Vlastimil Babka <vbabka@...e.cz>
To: Masahiro Yamada <masahiroy@...nel.org>
Cc: Matthias Maennich <maennich@...gle.com>, Jonathan Corbet
 <corbet@....net>, Luis Chamberlain <mcgrof@...nel.org>,
 Petr Pavlu <petr.pavlu@...e.com>, Sami Tolvanen <samitolvanen@...gle.com>,
 Daniel Gomez <da.gomez@...sung.com>, Nathan Chancellor <nathan@...nel.org>,
 Nicolas Schier <nicolas.schier@...ux.dev>,
 Alexander Viro <viro@...iv.linux.org.uk>,
 Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>,
 Christoph Hellwig <hch@...radead.org>, Peter Zijlstra
 <peterz@...radead.org>, David Hildenbrand <david@...hat.com>,
 Shivank Garg <shivankg@....com>, "Jiri Slaby (SUSE)" <jirislaby@...nel.org>,
 Stephen Rothwell <sfr@...b.auug.org.au>, linux-doc@...r.kernel.org,
 linux-kernel@...r.kernel.org, linux-modules@...r.kernel.org,
 linux-kbuild@...r.kernel.org, linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH 1/2] module: Restrict module namespace access to in-tree
 modules

On 7/8/25 14:41, Masahiro Yamada wrote:
> On Tue, Jul 8, 2025 at 4:29 PM Vlastimil Babka <vbabka@...e.cz> wrote:
>>
>> The module namespace support has been introduced to allow restricting
>> exports to specific modules only, and intended for in-tree modules such
>> as kvm. Make this intention explicit by disallowing out of tree modules
>> both for the module loader and modpost.
>>
>> Signed-off-by: Vlastimil Babka <vbabka@...e.cz>
> 
> 
> 
> In my understanding, an external module with the same name
> can override the internal one.
> 
> This change disallows such a use-case.

Hmm I'm not familiar with this, but for such cases to be legitimate we can
assume the external module has to be derived from the internal one and not
something completely unrelated impersonating the internal one? So in that
case just patch 2 alone would be sufficient and not break any legitimate use
cases?