Re: Looking for feedback on CONFIG_MODULE_HASHES for Linux

Path	csiph.com!weretis.net!feeder8.news.weretis.net!news.samoylyk.net!gothmog.csi.it!bofh.it!news.nic.it!robomod
From	Bastian Blank <waldi@debian.org>
Newsgroups	linux.debian.kernel
Subject	Re: Looking for feedback on CONFIG_MODULE_HASHES for Linux
Date	Sat, 22 Nov 2025 17:00:01 +0100
Message-ID	<LTYbL-eVH2-1@gated-at.bofh.it> (permalink)
References	<LSy9H-dW90-3@gated-at.bofh.it> <LSy9H-dW90-1@gated-at.bofh.it>
X-Original-To	Fabian Grünbichler <debian@fabian.gruenbichler.email>, Thomas Weißschuh <thomas@t-8ch.de>
X-Mailbox-Line	From debian-kernel-request@lists.debian.org Sat Nov 22 15:57:10 2025
Old-Return-Path	<waldi@debian.org>
X-Amavis-Spam-Status	No, score=-109.411 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FOURLA=0.1, LDO_WHITELIST=-5, RCVD_IN_DNSWL_MED=-2.3, USER_IN_DKIM_WELCOMELIST=-0.01, USER_IN_DKIM_WHITELIST=-100] autolearn=ham autolearn_force=no
Mail-Followup-To	Fabian Grünbichler <debian@fabian.gruenbichler.email>, Thomas Weißschuh <thomas@t-8ch.de>, rb-general <rb-general@lists.reproducible-builds.org>, debian-kernel@lists.debian.org
MIME-Version	1.0
Content-Type	text/plain; charset=utf-8
Content-Disposition	inline
Content-Transfer-Encoding	8bit
X-Mailing-List	<debian-kernel@lists.debian.org> archive/latest/152401
List-ID	<debian-kernel.lists.debian.org>
List-URL	<https://lists.debian.org/debian-kernel/>
List-Archive	https://lists.debian.org/msgid-search/20251122154105.ygqoqpig32rsglnr@shell.thinkmo.de
Approved	robomod@news.nic.it
Lines	43
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Cc	rb-general <rb-general@lists.reproducible-builds.org>, debian-kernel@lists.debian.org
X-Original-Date	Sat, 22 Nov 2025 16:41:05 +0100
X-Original-Message-ID	<20251122154105.ygqoqpig32rsglnr@shell.thinkmo.de>
X-Original-References	<1909c6cd-9684-4baf-bf54-b4e915718670@t-8ch.de> <2b4fafe1-d600-4ff5-90b9-837f92f5bd72@app.fastmail.com>
Xref	csiph.com linux.debian.kernel:90192

Show key headers only | View raw

On Tue, Nov 18, 2025 at 06:32:35PM +0100, Fabian Grünbichler wrote:
> On Thu, Nov 13, 2025, at 9:10 PM, Thomas Weißschuh via rb-general wrote:
> > The current form of the patches can be found at [1], they are only slightly
> > adapted from the previous submission to LKML.

I'll try and take a look at those.

> > adapted from the previous submission to LKML. Remaining open topics before the
> > next submission are proper IMA support and stripping of modules.

Yeah, stripping is a critical feature.  My take on that would be
something like that:
- During the build process, not only link .ko, but also directly create
  the stripped version as maybe .ko.strip.
- INSTALL_MOD_STRIP will then only select which of the two files to
  install, not actually call strip.

As additional thing: To mimic the current behaviour of the Debian
package, where we don't sign the unstripped files shipped for debugging
help, we only want the stripped versions show up as hashes.  But this we
could do on our own.  In the end this may reduce the attack surface due
to a lot more debugging info.

> > So if you are packaging Linux for your distribution, have looked at my 
> > patches
> > and are eager to use them, please let me know. My plan is to talk with 
> > the
> > upstream maintainers at the upcoming Linux Plumbers Conference on 11th 
> > of December.
> Given the recent discussion on IRC about this, I figured this might be
> the easiest way to get the ball rolling on potentially getting this patch
> series endorsed/.. by the Debian kernel team - or at least getting a
> written expression of interest or further discussion :)

Thank you for bringing this up.  Yes, Debian is interested in this patch
set, so we can make our kernel builds reproducible again.

Bastian

-- 
We Klingons believe as you do -- the sick should die.  Only the strong
should live.
		-- Kras, "Friday's Child", stardate 3497.2

Back to linux.debian.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: Looking for feedback on CONFIG_MODULE_HASHES for Linux Fabian Grünbichler <debian@fabian.gruenbichler.email> - 2025-11-18 19:00 +0100
  Re: Looking for feedback on CONFIG_MODULE_HASHES for Linux Bastian Blank <waldi@debian.org> - 2025-11-22 17:00 +0100

csiph-web