Re: kernel module loading vs securelevel

2010-10-18 Thread Jean-Yves Migeon
On Sun, 17 Oct 2010 20:11:06 -0400, Thor Lancelot Simon t...@panix.com wrote: On Sun, Oct 17, 2010 at 04:04:59PM -0400, Matthew Mondor wrote: On Sat, 16 Oct 2010 13:58:19 -0400 Thor Lancelot Simon t...@panix.com wrote: 2) Finish the asymmetric operation support in cryptodev and

Re: How to make module autoloading play nice with securelevel

2010-10-18 Thread Jean-Yves Migeon
On Sun, 17 Oct 2010 21:34:09 -0400, Michael Richardson m...@sandelman.ottawa.on.ca wrote: Let me ask two highlevel questions: 1) what class of systems care to enable securelevel, yet still need to load some random set of modules after boot? Are they x86 desktops or

Re: kernel module loading vs securelevel

2010-10-18 Thread Steven Bellovin
On Oct 18, 2010, at 8:51 03AM, Jean-Yves Migeon wrote: On Sun, 17 Oct 2010 20:11:06 -0400, Thor Lancelot Simon t...@panix.com wrote: On Sun, Oct 17, 2010 at 04:04:59PM -0400, Matthew Mondor wrote: On Sat, 16 Oct 2010 13:58:19 -0400 Thor Lancelot Simon t...@panix.com wrote: 2) Finish

Re: kernel module loading vs securelevel

2010-10-18 Thread Matthew Mondor
On Mon, 18 Oct 2010 14:51:03 +0200 Jean-Yves Migeon jeanyves.mig...@free.fr wrote: *lurker mode off* IIRC, part of agc work with netpgp is to integrate signature verification within kernel. *lurker mode on* Thanks, that's nice to know, I didn't look at netpgp yet but might eventually check

Re: kernel module loading vs securelevel

2010-10-18 Thread Matthew Mondor
On Mon, 18 Oct 2010 09:31:32 -0400 Steven Bellovin s...@cs.columbia.edu wrote: Signatures provide *authentication*; what is needed here is *authorization*. While I agree, there also are situations were both can be welcome... Another solution someone proposed which I like is hashing the modules

Re: kernel module loading vs securelevel

2010-10-18 Thread Jean-Yves Migeon
On Mon, 18 Oct 2010 09:31:32 -0400, Steven Bellovin s...@cs.columbia.edu wrote: *lurker mode off* IIRC, part of agc work with netpgp is to integrate signature verification within kernel. *lurker mode on* Signatures provide *authentication*; what is needed here is *authorization*. And

cxgb(4) man page missing, otherwise undocumented

2010-10-18 Thread Thor Lancelot Simon
Casting about for current-production 10Gb adapters I could use with NetBSD, I stumbled across the cxgb driver. These devices are not in any of the (admittedly somewhat poorly organized) hardware compatibility lists I can find on www.netbsd.org, nor is there a manual page! Does this driver work?

Re: [ANN] Lunatik -- NetBSD kernel scripting with Lua (GSoC project results)

2010-10-18 Thread Lourival Vieira Neto
On Tue, Oct 12, 2010 at 3:47 AM, Alan Barrett a...@cequrux.com wrote: [cross-posting removed] On Tue, 05 Oct 2010, Lourival Vieira Neto wrote: We've created the support for scripting the NetBSD kernel with Lua, Instead of using long long as the C data type for Lua variables, I suggest

Re: [ANN] Lunatik -- NetBSD kernel scripting with Lua (GSoC project results)

2010-10-18 Thread Lourival Vieira Neto
On Mon, Oct 11, 2010 at 11:50 PM, Matthew Mondor mm_li...@pulsar-zone.net wrote: On Sun, 10 Oct 2010 19:45:41 -0600 Samuel Greear l...@evilcode.net wrote: I didn't like the fact that the only option for loading a script into the kernel was to load the script source. I would make loading