Re: Fw: signed kernel modules?

[David Woodhouse <dwmw2@infradead.org>]

On Wed, 2004-10-13 at 10:11 +1000, Rusty Russell (IBM) wrote:
> Here's the level of paranoia required for the simplest case, that of
> signing the entire module.  The last Howells patches I saw didn't even
> do any of *this*, let alone checking the rest of the module:

It's work in progress, and from my limited and third-hand understanding
of what went on before this thread became public, you seemed to be
railing against the _concept_ not against the implementation.

We agree that the checks you cite are required. In fact we should have
been doing a lot of these checks even _before_ we thought about signing
modules.

That said, I think it was perfectly reasonable for David to leave the
implementation of this level of paranoia till last, after working out
the details of how the signatures actually work.

After all, until the precise signature scheme is agreed upon we don't
really know how much of the ELF we should be paranoid about, and how
much we can trust because it's signed.

In David's original scheme, the signature covered only the relevant
parts of the module, so it survives the removal of debug info, and it
survives the further 'strip' it gets on being put into an initrd -- but
the signature _doesn't_ survive anything which would actually change
what happens when the module is loaded.

If your objection to that is purely on the perfectly reasonable grounds
that we're overly trusting of what could be invalid ELF, and could kill
us before we actually get to checking the signature, we can just wait
for him to complete what he's working on at the moment and all will
presumably be well.

I had the impression you were rabidly against any scheme which didn't
sign the _whole_ module, irrelevant parts and all.

-- 
dwmw2