Re: [RFC PATCH] Fix: module signature vs tracepoints: add new TAINT_UNSIGNED_MODULE

[Steven Rostedt]

I need to clean out my email box. This email was hidden in between a
pile of other crap email.

On Fri, 14 Feb 2014 11:21:19 +1030
Rusty Russell <rusty@xxxxxxxxxxxxxxx> wrote:

> Steven Rostedt <rostedt@xxxxxxxxxxx> writes:
> > On Thu, 13 Feb 2014 13:54:42 +1030
> > Rusty Russell <rusty@xxxxxxxxxxxxxxx> wrote:
> >
> >
> >> I'm ambivalent towards out-of-tree modules, so not tempted unless I see
> >> a bug report indicating a concrete problem.  Then we can discuss...
> >
> > As I replied in another email, this is a concrete problem, and affects
> > in-tree kernel modules.
> >
> > If you have the following in your .config:
> >
> > CONFIG_MODULE_SIG=y
> > # CONFIG_MODULE_SIG_FORCE is not set
> > # CONFIG_MODULE_SIG_ALL is not set
> 
> This means you've set the "I will arrange my own module signing" config
> option:
> 
> 	  Sign all modules during make modules_install. Without this option,
> 	  modules must be signed manually, using the scripts/sign-file tool.
> 
> comment "Do not forget to sign required modules with scripts/sign-file"
> 	depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL
> 
> Then you didn't do that.  You broke it, you get to keep both pieces.

In this case we should fail the module load all together, and require
insmod to add the --force flag to load it. Why the hell are we setting
a FORCED_MODULE flag when no module was forced????

-- Steve

> 
> Again: is there an actual valid use case?
> Rusty.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/