Re: [RFC PATCH] Fix: module signature vs tracepoints: add new TAINT_UNSIGNED_MODULE

[Rusty Russell <rusty@rustcorp.com.au>]

Steven Rostedt <rostedt@goodmis.org> writes:
> I need to clean out my email box. This email was hidden in between a
> pile of other crap email.
>
> On Fri, 14 Feb 2014 11:21:19 +1030
> Rusty Russell <rusty@rustcorp.com.au> wrote:
>
>> Steven Rostedt <rostedt@goodmis.org> writes:
>> > On Thu, 13 Feb 2014 13:54:42 +1030
>> > Rusty Russell <rusty@rustcorp.com.au> wrote:
>> >
>> >
>> >> I'm ambivalent towards out-of-tree modules, so not tempted unless I see
>> >> a bug report indicating a concrete problem.  Then we can discuss...
>> >
>> > As I replied in another email, this is a concrete problem, and affects
>> > in-tree kernel modules.
>> >
>> > If you have the following in your .config:
>> >
>> > CONFIG_MODULE_SIG=y
>> > # CONFIG_MODULE_SIG_FORCE is not set
>> > # CONFIG_MODULE_SIG_ALL is not set
>> 
>> This means you've set the "I will arrange my own module signing" config
>> option:
>> 
>> 	  Sign all modules during make modules_install. Without this option,
>> 	  modules must be signed manually, using the scripts/sign-file tool.
>> 
>> comment "Do not forget to sign required modules with scripts/sign-file"
>> 	depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL
>> 
>> Then you didn't do that.  You broke it, you get to keep both pieces.
>
> In this case we should fail the module load all together, and require
> insmod to add the --force flag to load it. Why the hell are we setting
> a FORCED_MODULE flag when no module was forced????

If this mistake of creating unsigned modules is common, then it would be
friendly to do something about it, yes.

Perhaps we should append UNSIGNED to vermagic, and then strip that out
when we sign the module?  That would have this effect.

Cheers,
Rusty.