Messages in this thread | | | Date | Fri, 21 Sep 2012 10:56:31 -0700 | From | John Johansen <> | Subject | Re: [PATCH 1/4] module: add syscall to load module from fd |
| |
On 09/20/2012 07:22 PM, James Morris wrote: > On Thu, 20 Sep 2012, Kees Cook wrote: > >> Earlier proposals for appending signatures to kernel modules would not be >> useful in Chrome OS, since it would involve adding an additional set of >> keys to our kernel and builds for no good reason: we already trust the >> contents of our root filesystem. We don't need to verify those kernel >> modules a second time. Having to do signature checking on module loading >> would slow us down and be redundant. All we need to know is where a >> module is coming from so we can say yes/no to loading it. > > Just out of interest, has anyone else expressed interest in using this > feature? > we are looking at using it in apparmor as well
| |