Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1722885

Re: Allow automatic kernel taint on unsigned module load to be disabled

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Tue, 2017-08-29 at 13:22 -0700, Matthew Garrett wrote:
> > On Tue, Aug 29, 2017 at 10:56 AM, Jessica Yu <jeyu@kernel.org> wrote:
> > I understand what the patch is doing, what I don't yet understand is
> > _why_ you would want to remove the unsigned module taint when
> > CONFIG_MODULE_SIG is enabled. Which distributions are asking for this
> > exactly, and for what use cases? I find it a bit contradictory to have
> > CONFIG_MODULE_SIG enabled and at the same time expect the kernel to
> > behave as if the option wasn't enabled.
> 
> Debian disable CONFIG_MODULE_SIG because of this additional taint
> (I've Cc:ed Ben who made this change).

The current state of affairs is that Debian doesn't have the mechanism
in place to sign modules with a trusted key.  If we were to allow third
parties to add signatures in some way (I think that's what Matthew's
interested in doing) we would have to enabled CONFIG_MODULE_SIG, but
that would cause modules to be tainted by default.

> > I would really prefer not to add extra code to remove what is cosmetic
> > and still has informational/debug value. If the unsigned module taint
> > is for whatever reason that bothersome, why can't distro(s) carry a
> > 2-line patch removing the message and taint for those particular
> > setups where signatures are considered "irrelevant" even with
> > CONFIG_MODULE_SIG=y?
> 
> If it's functionality that distributions want to patch out, it makes
> sense to provide them with a config option rather than forcing them to
> maintain a patch separately.

We could use this in Debian.  It would likely be a temporary stage
until we do our own centralised module signing (or someone implements a
Merkle tree for in-tree modules).

Ben.

-- 
Ben Hutchings
Teamwork is essential - it allows you to blame someone else.

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: Allow automatic kernel taint on unsigned module load to be  disabled Jessica Yu <jeyu@kernel.org> - 2017-08-29 20:00 +0200
  Re: Allow automatic kernel taint on unsigned module load to be disabled Matthew Garrett <mjg59@google.com> - 2017-08-29 22:30 +0200
    Re: Allow automatic kernel taint on unsigned module load to be  disabled Ben Hutchings <ben@decadent.org.uk> - 2017-08-30 00:10 +0200

csiph-web