On Sun, 2016-07-31 at 21:44 -0400, Linus Torvalds wrote: > So this feels wrong to me, can you guys please explain: > > On Sun, Jul 31, 2016 at 9:02 PM, Rusty Russell <ru...@rustcorp.com.au> wrote: > > > > Ben Hutchings (3): > > module: Invalidate signatures on force-loaded modules > > module: Disable MODULE_FORCE_LOAD when MODULE_SIG_FORCE is enabled > > forcing a load and SIG_FORCE are entirely independent issues, afaik. I > think requiring signed modules is just a good idea. But that doesn't > necessarily mean that you don't have a signed module that is signed > with a key you trust, but you still want to force-load it for the > wrong kernel version (ie maybe you have a binary-only module from your > IT department (and your IT department is evil,but at least they sign > it to show that the module is trust-worthy as coming from them, even > if they have some dubious behavior), but you did some kernel updates > that still allow the module to work but the version doesn't match any > more).
We discussed this before and I thought you were happy with this version. If the use case you describe is at all common, it could perhaps be handled by having a tool that patches the version information and re-signs the module with a different trusted key. > Am I missing something? What's the connection between > MODULE_FORCE_LOAD and MODULE_SIG_FORCE? Because it smells like they > are independent and that the above changes are very very dubious. As I understand it: - module signature enforcement means that root is not trusted to load arbitrary code into the kernel; instead the code has to be approved by one of the signing key holders - force-loading a module means "I promise that this module is ABI compatible, even though it doesn't appear to be" No-one signs that promise, and if it's false, the ABI differences could mean that an otherwise benign module would compromise the kernel. So as I see it, the kernel should not trust a force-loaded signed module any more than an unsigned module. If you still think that module signature enforcement is compatible with force-loading, I would like to know what you consider the purpose of enforcement to be. Ben. > I didn't actually pull the tree, I just reacted to the pull request itself. > > Linus -- Ben Hutchings Sturgeon's Law: Ninety percent of everything is crap.
signature.asc
Description: This is a digitally signed message part