linux-modules.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH -v2 0/7] module: Strict per-modname namespaces
@ 2024-12-02 14:59 Peter Zijlstra
  2024-12-02 14:59 ` [PATCH -v2 1/7] module: Convert symbol namespace to string literal Peter Zijlstra
                   ` (9 more replies)
  0 siblings, 10 replies; 31+ messages in thread
From: Peter Zijlstra @ 2024-12-02 14:59 UTC (permalink / raw)
  To: mcgrof
  Cc: x86, hpa, petr.pavlu, samitolvanen, da.gomez, masahiroy, nathan,
	nicolas, linux-kernel, linux-modules, linux-kbuild, hch, gregkh

Hi!

Implement a means for exports to be available only to an explicit list of named
modules. By explicitly limiting the usage of certain exports, the abuse
potential/risk is greatly reduced.

The first 'patch' is an awk scripts that cleans up the existing module
namespace code along the same lines of commit 33def8498fdd ("treewide: Convert
macro and uses of __section(foo) to __section("foo")") and for the same reason,
it is not desired for the namespace argument to be a macro expansion itself.

The remainder of the patches introduce the special "MODULE_<modname-list>"
namespace, which shall be forbidden from being explicitly imported. A module
that matches the simple modname-list will get an implicit import.

Lightly tested with something like:

  git grep -l EXPORT_SYMBOL arch/x86/kvm/ | while read file;
  do
    sed -i -e 's/EXPORT_SYMBOL_GPL(\(.[^)]*\))/EXPORT_SYMBOL_GPL_FOR(\1, "kvm,kvm-intel,kvm-amd")/g' $file;
  done

With that, some configs generate:

  ERROR: modpost: module kvmgt uses symbol kvm_write_track_add_gfn from namespace MODULE_kvm,kvm-intel,kvm-amd, but does not import it.
  ERROR: modpost: module kvmgt uses symbol kvm_write_track_remove_gfn from namespace MODULE_kvm,kvm-intel,kvm-amd, but does not import it.
  ERROR: modpost: module kvmgt uses symbol kvm_page_track_register_notifier from namespace MODULE_kvm,kvm-intel,kvm-amd, but does not import it.
  ERROR: modpost: module kvmgt uses symbol kvm_page_track_unregister_notifier from namespace MODULE_kvm,kvm-intel,kvm-amd, but does not import it.

Showing it works :-). Also verified that once booted, the module kvm_intel does
actually load.


Also available at:

  git://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue.git module/namespace

Changes since RFC/v1:

 - use awk instead of sed so all changes are a single script (hch)
 - deal with kbuild mangling the module names like s/-/_/g (sean)
 - fixup clang-ias 'funnies'


^ permalink raw reply	[flat|nested] 31+ messages in thread

end of thread, other threads:[~2025-05-02 13:16 UTC | newest]

Thread overview: 31+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-12-02 14:59 [PATCH -v2 0/7] module: Strict per-modname namespaces Peter Zijlstra
2024-12-02 14:59 ` [PATCH -v2 1/7] module: Convert symbol namespace to string literal Peter Zijlstra
2024-12-02 15:15   ` Peter Zijlstra
2024-12-02 15:22     ` Greg KH
2024-12-02 19:33     ` Linus Torvalds
2024-12-03 19:19       ` Mark Brown
2024-12-03 22:06         ` Mark Brown
2024-12-04  1:11           ` Masahiro Yamada
2024-12-02 14:59 ` [PATCH -v2 2/7] module/modpost: Use for() loop Peter Zijlstra
2025-02-07  8:50   ` Masahiro Yamada
2025-02-07 16:38   ` Masahiro Yamada
2024-12-02 14:59 ` [PATCH -v2 3/7] module/modpost: Add basename helper Peter Zijlstra
2025-02-07 17:56   ` Masahiro Yamada
2024-12-02 14:59 ` [PATCH -v2 4/7] module: Add module specific symbol namespace support Peter Zijlstra
2025-02-07 16:22   ` Masahiro Yamada
2024-12-02 14:59 ` [PATCH -v2 5/7] module: Extend the MODULE_ namespace parsing Peter Zijlstra
2025-02-07  8:41   ` Masahiro Yamada
2025-05-02 13:10     ` Peter Zijlstra
2025-02-07 15:45   ` Masahiro Yamada
2025-05-02 13:11     ` Peter Zijlstra
2024-12-02 14:59 ` [PATCH -v2 6/7] module: Account for the build time module name mangling Peter Zijlstra
2024-12-06 18:35   ` Sean Christopherson
2025-05-02 13:15   ` Peter Zijlstra
2024-12-02 14:59 ` [PATCH -v2 7/7] module: Provide EXPORT_SYMBOL_GPL_FOR() helper Peter Zijlstra
2025-02-07  8:09   ` Masahiro Yamada
2024-12-02 17:36 ` [PATCH -v2 0/7] module: Strict per-modname namespaces Andi Kleen
2024-12-16 16:43 ` Petr Pavlu
2025-02-05 10:14   ` Petr Pavlu
2025-02-07 18:04     ` Masahiro Yamada
2025-05-02 11:55 ` Roy, Patrick
2025-05-02 12:55   ` Peter Zijlstra

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).