* dlopen-like facility for conditional loading of symbols in modules (Re: Firmware for new ti_usb_3410_5052 devices) [not found] ` <200703030840.26982.oliver@neukum.org> @ 2007-03-03 13:31 ` Oleg Verych 2007-03-04 2:51 ` H. Peter Anvin 0 siblings, 1 reply; 3+ messages in thread From: Oleg Verych @ 2007-03-03 13:31 UTC (permalink / raw) To: Oliver Neukum Cc: linux-usb-devel, Greg KH, Dale Martenson, Al Borchers, LKML, mit-devel On Sat, Mar 03, 2007 at 08:40:26AM +0100, Oliver Neukum wrote: > Am Samstag, 3. M?rz 2007 01:29 schrieb Greg KH: > > On Sat, Mar 03, 2007 at 01:27:07AM +0100, Oleg Verych wrote: > > > > > > If you can proof that it doesn't influence kernel's control above system > > > hardware. Ironically such stuff in the userspace can give additional > > > intrusion way to the kernel. > > > > Do you know of any way to use the firmware interface to the kernel for > > intrusion? If so, please let us know and we will fix it. > > If you can determine firmware for a block device whose filesystem is > then mounted with suid allowed or whose files root runs, you've rooted > the box. > Firmware needs the same level of protection as kernel modules on disk. This > is a basic feature of the system and can't be avoided. If you are paranoid > enough to compile your kernel without module loading, you also have > to disable firmware loading for block (and net due to nfs/cifs) devices. Maybe modules' dlopen() like facility would be better to handle static firmware or any other on-demand static data like ID tables etc.? I.e. some additional flag for an exported symbol (in a module), that this symbol maybe dynamically requested and used. As far as i can see, depmod generates static map, unresolved symbols must be in the kernel (System.map). It will solve problem of having multiple unneeded firmware images if driver handles many devices and firmware is allowed to be in the kernel. No need in additional secure infrastructure. p.s. LKML, mit-devel added. Maybe this can be done easily and somebody knows that. ____ ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: dlopen-like facility for conditional loading of symbols in modules (Re: Firmware for new ti_usb_3410_5052 devices) 2007-03-03 13:31 ` dlopen-like facility for conditional loading of symbols in modules (Re: Firmware for new ti_usb_3410_5052 devices) Oleg Verych @ 2007-03-04 2:51 ` H. Peter Anvin 2007-03-04 15:03 ` Oleg Verych 0 siblings, 1 reply; 3+ messages in thread From: H. Peter Anvin @ 2007-03-04 2:51 UTC (permalink / raw) To: Oleg Verych Cc: Oliver Neukum, linux-usb-devel, Greg KH, Dale Martenson, Al Borchers, LKML, mit-devel Oleg Verych wrote: > > Maybe modules' dlopen() like facility would be better to handle static > firmware or any other on-demand static data like ID tables etc.? > > I.e. some additional flag for an exported symbol (in a module), that > this symbol maybe dynamically requested and used. As far as i can see, > depmod generates static map, unresolved symbols must be in the kernel > (System.map). > You can do this with request_module() and having your module overwrite a hook. > It will solve problem of having multiple unneeded firmware images if > driver handles many devices and firmware is allowed to be in the > kernel. No need in additional secure infrastructure. > This seems like a hacky way to accomplish what request_firmware() does clearer! -hpa ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: dlopen-like facility for conditional loading of symbols in modules (Re: Firmware for new ti_usb_3410_5052 devices) 2007-03-04 2:51 ` H. Peter Anvin @ 2007-03-04 15:03 ` Oleg Verych 0 siblings, 0 replies; 3+ messages in thread From: Oleg Verych @ 2007-03-04 15:03 UTC (permalink / raw) To: H. Peter Anvin Cc: Oliver Neukum, linux-usb-devel, Greg KH, Dale Martenson, Al Borchers, LKML, mit-devel On Sat, Mar 03, 2007 at 06:51:51PM -0800, H. Peter Anvin wrote: [] > >It will solve problem of having multiple unneeded firmware images if > >driver handles many devices and firmware is allowed to be in the > >kernel. No need in additional secure infrastructure. > > > > This seems like a hacky way to accomplish what request_firmware() does > clearer! (Among other its clear features) after nearly four years being in the kernel -- i don't think so. I will try to check request_module(). Maybe this is a hack, but it's way more supported and bloat-ware independent (:. ____ ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2007-03-04 14:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <1172824155.45e7e05b7980e@my.visi.com>
[not found] ` <20070303002707.GJ16509@flower.upol.cz>
[not found] ` <20070303002957.GA1966@kroah.com>
[not found] ` <200703030840.26982.oliver@neukum.org>
2007-03-03 13:31 ` dlopen-like facility for conditional loading of symbols in modules (Re: Firmware for new ti_usb_3410_5052 devices) Oleg Verych
2007-03-04 2:51 ` H. Peter Anvin
2007-03-04 15:03 ` Oleg Verych
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.