show all modules which taint the kernel ?

show all modules which taint the kernel ?

[devzero]

Hello !

i wonder if there is a command which lets me determine at runtime, if there is any module loaded which taints the kernel. (not from dmesg)

i would have expected a special option to lsmod which shows this information with every module.

ok, there is modinfo which will tell me "supported : yes" for single modules , but output is somewhat inconsistent and i would need to write a little script which combines lsmod and modinfo to show appropriate information.

e.g. - this is a module delivered with the kernel package:

vserver2:/proc # modinfo ac
filename:       /lib/modules/2.6.8-24.24-default/kernel/drivers/acpi/ac.ko
author:         Paul Diefenbaugh
description:    ACPI AC Adapter Driver
license:        GPL
vermagic:       2.6.8-24.24-default 586 REGPARM gcc-3.3
supported:      yes  <- (!)
depends:


this is a module  compiled and installed afterwards:

vserver2:/proc # modinfo fuse
filename:       /lib/modules/2.6.8-24.24-default/kernel/fs/fuse/fuse.ko
alias:          char-major-10-229
author:         Miklos Szeredi <miklos@szeredi.hu>
description:    Filesystem in Userspace
license:        GPL
vermagic:       2.6.8-24.24-default 586 REGPARM gcc-3.3
depends:

i would have expected "supported:   no" or "attention, this module taints the kernel!", because when loading it gave:

"Sep 15 20:02:46 vserver2 kernel: fuse: module not supported by Novell, setting U taint flag."

how can i read that information "U taint"  AFTER loading a (binary...) module ?

i think it would be useful to have an easy way to list all modules which taint the kernel, so we can see quick, which crappy binary module is running inside a user`s kernel.

furthermore -  i came across a strange posting on the vmware forum:

a user complains about a kernel panic and there is a discussion if it`s due to bug in vmware kernel module or aacraid driver.

whoever is the evil one -  the kernel panic message shows every module with an "(U)" flag:

List corruption. next->prev should be f7481858, but was f748313c
------------[ cut here ]------------
kernel BUG at include/linux/list.h:185!
invalid opcode: 0000 [#1]
SMP
last sysfs file: /class/scsi_host/host0/proc_name
Modules linked in: radeon(U) drm(U) ipv6(U) autofs4(U) ppdev(U) lm85(U) w83781d
(U) hwmon_vid(U) hwmon(U) i2c_isa(U) vmnet(U) vmmon(U) sunrpc(U) vfat(U) fat
(U) dm_mirror(U) dm_mod(U) video(U) button(U) battery(U) ac(U) lp(U) parport_pc
(U) parport(U) snd_intel8x0(U) snd_ac97_codec(U) snd_ac97_bus(U) ftdi_sio(U)
snd_seq_dummy(U) usbserial(U) snd_seq_oss(U) snd_seq_midi_event(U) snd_seq(U)
snd_seq_device(U) snd_pcm_oss(U) snd_mixer_oss(U) 3c59x(U) snd_pcm(U) e1000(U)
mii(U) ohci1394(U) ieee1394(U) snd_timer(U) sg(U) snd(U) uhci_hcd(U) ehci_hcd
(U) i2c_i801(U) serio_raw(U) soundcore(U) e7xxx_edac(U) snd_page_alloc(U)
floppy(U) i2c_core(U) edac_mc(U) ext3(U) jbd(U) aacraid(U) sd_mod(U) scsi_mod
(U)
CPU: 1
EIP: 0060:[<f88704ce>] Tainted: P VLI
EFLAGS: 00013096 (2.6.17-vmhost #1)
EIP is at aac_intr_normal+0x1cc/0x267 [aacraid] 

i wonder how someone can have so many tainted modules loaded at the same time, so i`m unsure if (U) means "tainted" in this context.

can someone probably explain ?

regards
roland

__________________________________________________________________________
Erweitern Sie FreeMail zu einem noch leistungsstärkeren E-Mail-Postfach!		
Mehr Infos unter http://freemail.web.de/home/landingpad/?mc=021131

Re: show all modules which taint the kernel ?

[Lee Revell]

On Sat, 2006-09-16 at 12:25 +0200, devzero@web.de wrote:
> i wonder how someone can have so many tainted modules loaded at the
> same time, so i`m unsure if (U) means "tainted" in this context.
> 
> can someone probably explain ?
> 

The (U) thing is a Novell/SuSE extension.  Problems with vendor kernels
should be reported to the vendor rather than LKML.

Lee

Re: show all modules which taint the kernel ?

[devzero]

but that "Modules linked in: radeon(U) drm(U) ipv6(U) autofs4(U)...." message has been reported to originate from a fc5 (fedora) kernel. fedora probably also using that novell/suse extension ?


> -----Ursprüngliche Nachricht-----
> Von: Lee Revell <rlrevell@joe-job.com>
> Gesendet: 16.09.06 18:26:52
> An: devzero@web.de
> CC: linux-kernel@vger.kernel.org
> Betreff: Re: show all modules which taint the kernel ?


> On Sat, 2006-09-16 at 12:25 +0200, devzero@web.de wrote:
> > i wonder how someone can have so many tainted modules loaded at the
> > same time, so i`m unsure if (U) means "tainted" in this context.
> > 
> > can someone probably explain ?
> > 
> 
> The (U) thing is a Novell/SuSE extension.  Problems with vendor kernels
> should be reported to the vendor rather than LKML.
> 
> Lee
> 


_______________________________________________________________________
Viren-Scan für Ihren PC! Jetzt für jeden. Sofort, online und kostenlos.
Gleich testen! http://www.pc-sicherheit.web.de/freescan/?mc=022222

Re: show all modules which taint the kernel ?

[Dave Jones]

On Sat, Sep 16, 2006 at 08:58:20PM +0200, devzero@web.de wrote:
 > but that "Modules linked in: radeon(U) drm(U) ipv6(U) autofs4(U)...." message has been reported to originate from a fc5 (fedora) kernel. fedora probably also using that novell/suse extension ?

Different. The Fedora kernel reports U for modules that weren't shipped with
the Fedora kernel. (It uses gpg signed modules).

	Dave

Re: show all modules which taint the kernel ?

[Lee Revell]

On Sat, 2006-09-16 at 19:46 -0400, Dave Jones wrote:
> On Sat, Sep 16, 2006 at 08:58:20PM +0200, devzero@web.de wrote:
>  > but that "Modules linked in: radeon(U) drm(U) ipv6(U) autofs4(U)...." message has been reported to originate from a fc5 (fedora) kernel. fedora probably also using that novell/suse extension ?
> 
> Different. The Fedora kernel reports U for modules that weren't shipped with
> the Fedora kernel. (It uses gpg signed modules).

Vendor kernels aside, would it be useful for mainline to report this
information - something like nvidia(P) in the module list?

Lee

Re: show all modules which taint the kernel ?

[devzero]

if there is a "contaminant" inside the kernel, why should one see this only when it`s being inserted (i.e. usually at boot time) ?

i don`t know about the "nvidia(P)..." thing, but i would find it really useful to be able to easily distinguish between the "good" and the "not belonging to this kernel" modules.

i have seem several discussions about "modules which taint the kernel are evil" - so why not pillory them by listing appropriate information with lsmod ?



> -----Ursprüngliche Nachricht-----
> Von: Lee Revell <rlrevell@joe-job.com>
> Gesendet: 17.09.06 02:01:05
> An: Dave Jones <davej@redhat.com>
> CC: linux-kernel@vger.kernel.org
> Betreff: Re: show all modules which taint the kernel ?


> On Sat, 2006-09-16 at 19:46 -0400, Dave Jones wrote:
> > On Sat, Sep 16, 2006 at 08:58:20PM +0200, devzero@web.de wrote:
> >  > but that "Modules linked in: radeon(U) drm(U) ipv6(U) autofs4(U)...." message has been reported to originate from a fc5 (fedora) kernel. fedora probably also using that novell/suse extension ?
> > 
> > Different. The Fedora kernel reports U for modules that weren't shipped with
> > the Fedora kernel. (It uses gpg signed modules).
> 
> Vendor kernels aside, would it be useful for mainline to report this
> information - something like nvidia(P) in the module list?
> 
> Lee
> 


_____________________________________________________________________
Der WEB.DE SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen!
http://smartsurfer.web.de/?mc=100071&distributionid=000000000066

Re: show all modules which taint the kernel ?

[Alistair John Strachan]

On Sunday 17 September 2006 10:34, devzero@web.de wrote:
> if there is a "contaminant" inside the kernel, why should one see this only
> when it`s being inserted (i.e. usually at boot time) ?
>
> i don`t know about the "nvidia(P)..." thing, but i would find it really
> useful to be able to easily distinguish between the "good" and the "not
> belonging to this kernel" modules.
>
> i have seem several discussions about "modules which taint the kernel are
> evil" - so why not pillory them by listing appropriate information with
> lsmod ?

I think the point being made is that we don't want to confuse this with 
vendors disclaiming support for non-shipped kernel modules. Vanilla kernels 
shouldn't consider GPL modules to be "unsupported" just because they aren't 
shipped or "digitally signed"; however we certainly should be highlighting 
the use of proprietary modules (which are obviously impossible to debug).

I agree with Lee, there should be some more black marks on proprietary drivers 
than there are currently.

-- 
Cheers,
Alistair.

Final year Computer Science undergraduate.
1F2 55 South Clerk Street, Edinburgh, UK.