From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755963AbcHBEfL (ORCPT ); Tue, 2 Aug 2016 00:35:11 -0400 Received: from ozlabs.org ([103.22.144.67]:50854 "EHLO ozlabs.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751033AbcHBEfF (ORCPT ); Tue, 2 Aug 2016 00:35:05 -0400 From: Rusty Russell To: Linus Torvalds Cc: lkml , Ben Hutchings , Jessica Yu , Jiri Kosina , Kees Cook , Libor Pechacek , Paul Gortmaker , Prarit Bhargava , Steven Rostedt Subject: Re: [PULL] modules-next In-Reply-To: References: <87y44hxpwi.fsf@rustcorp.com.au> User-Agent: Notmuch/0.21 (http://notmuchmail.org) Emacs/24.5.1 (x86_64-pc-linux-gnu) Date: Tue, 02 Aug 2016 09:40:14 +0930 Message-ID: <87shuoxc7t.fsf@rustcorp.com.au> MIME-Version: 1.0 Content-Type: text/plain Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Linus Torvalds writes: > So this feels wrong to me, can you guys please explain: > > On Sun, Jul 31, 2016 at 9:02 PM, Rusty Russell wrote: >> >> Ben Hutchings (3): >> module: Invalidate signatures on force-loaded modules >> module: Disable MODULE_FORCE_LOAD when MODULE_SIG_FORCE is enabled > > forcing a load and SIG_FORCE are entirely independent issues, afaik. I > think requiring signed modules is just a good idea. But that doesn't > necessarily mean that you don't have a signed module that is signed > with a key you trust, but you still want to force-load it for the > wrong kernel version (ie maybe you have a binary-only module from your > IT department (and your IT department is evil,but at least they sign > it to show that the module is trust-worthy as coming from them, even > if they have some dubious behavior), but you did some kernel updates > that still allow the module to work but the version doesn't match any > more). > > Am I missing something? What's the connection between > MODULE_FORCE_LOAD and MODULE_SIG_FORCE? Because it smells like they > are independent and that the above changes are very very dubious. > > I didn't actually pull the tree, I just reacted to the pull request itself. Well, MODULE_FORCE_LOAD is really "I am a doing crazy shit", and MODULE_SIG_FORCE is "Don't let me do crazy shit". You have to contrive pretty hard to get a situation where the combination makes sense, so I tend to let Ben worry about the module signing stuff. I can pull them out of modules-next if you'd prefer. Cheers, Rusty.