From: Rusty Russell <rusty@rustcorp.com.au>
To: Kees Cook <keescook@chromium.org>, Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: linux-kernel@vger.kernel.org,
Serge Hallyn <serge.hallyn@canonical.com>,
James Morris <james.l.morris@oracle.com>,
Al Viro <viro@zeniv.linux.org.uk>, Eric Paris <eparis@redhat.com>,
Jiri Kosina <jkosina@suse.cz>,
linux-security-module@vger.kernel.org,
Chris Wright <chrisw@sous-sol.org>
Subject: Re: [PATCH 1/2] module: add syscall to load module from fd
Date: Mon, 10 Sep 2012 11:16:48 +0930 [thread overview]
Message-ID: <87d31ufy47.fsf@rustcorp.com.au> (raw)
In-Reply-To: <CAGXu5jKvg9Dhu-PLCZkPazSTFSngg5nzU6Ss4CZ2qaHZ7rugXA@mail.gmail.com>
Kees Cook <keescook@chromium.org> writes:
> On Fri, Sep 7, 2012 at 10:12 AM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
>> This method is a consistent and extensible approach to verifying the
>> integrity of file data/metadata, including kernel modules. The only
>> downside to this approach, I think, is that it requires changes to the
>> userspace tool.
>
> I'm fine with this -- it's an expected change that I'll pursue with
> glibc, kmod, etc. Without the userspace changes, nothing will use the
> new syscall. :) I've already got kmod (and older module-init-tools)
> patched to do this locally.
A syscall is the right way to do this. But does it need to be done?
1) Do the LSM guys really want this hook?
2) Do we have a userspace which uses it?
If yes to both, and noone comes up with any creative complaints, I will
take the patch.
Cheers,
Rusty.
next prev parent reply other threads:[~2012-09-10 2:31 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-06 18:13 [PATCH 1/2] module: add syscall to load module from fd Kees Cook
2012-09-06 18:13 ` [PATCH 2/2] security: introduce kernel_module_from_file hook Kees Cook
2012-09-07 0:15 ` [PATCH 1/2] module: add syscall to load module from fd Rusty Russell
2012-09-07 16:19 ` Kees Cook
2012-09-07 17:12 ` Mimi Zohar
2012-09-07 17:19 ` Kees Cook
2012-09-07 19:04 ` Mimi Zohar
2012-09-10 1:46 ` Rusty Russell [this message]
2012-09-10 15:07 ` Kees Cook
2012-09-12 2:57 ` James Morris
2012-09-12 4:15 ` H. Peter Anvin
2012-09-12 7:34 ` Rusty Russell
2012-09-12 14:38 ` Kees Cook
2012-09-13 19:22 ` Mimi Zohar
2012-09-19 3:38 ` Rusty Russell
2012-09-19 14:41 ` Mimi Zohar
2012-09-19 16:15 ` Kees Cook
-- strict thread matches above, loose matches on Subject: below --
2012-09-07 18:38 Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87d31ufy47.fsf@rustcorp.com.au \
--to=rusty@rustcorp.com.au \
--cc=chrisw@sous-sol.org \
--cc=eparis@redhat.com \
--cc=james.l.morris@oracle.com \
--cc=jkosina@suse.cz \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=serge.hallyn@canonical.com \
--cc=viro@zeniv.linux.org.uk \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.