[RFC][PATCH 0/8] module: Strict per-modname namespaces
From: Peter Zijlstra
Date: Mon Nov 11 2024 - 06:19:45 EST
Hi!
Implement a means for exports to be available only to an explicit list of named
modules. By explicitly limiting the usage of certain exports, the abuse
potential/risk is greatly reduced.
The first three 'patches' clean up the existing export namespace code along the
same lines of 33def8498fdd ("treewide: Convert macro and uses of __section(foo)
to __section("foo")") and for the same reason, it is not desired for the
namespace argument to be a macro expansion itself.
In fact, the second patch is really only a script, because sending the output
to the list is a giant waste of bandwidth. Whoever eventually commits this to a
git tree should squash these first three patches.
The remainder of the patches introduce the special "MODULE_<modname-list>"
namespace, which shall be forbidden from being explicitly imported. A module
that matches the simple modname-list will get an implicit import.
Lightly tested with something like:
git grep -l EXPORT_SYMBOL arch/x86/kvm/ | while read file;
do
sed -i -e 's/EXPORT_SYMBOL_GPL(\(.[^)]*\))/EXPORT_SYMBOL_GPL_FOR(\1, "kvm,kvm-intel,kvm-amd")/g' $file;
done
Also available at:
git://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue.git module/namespace