lkml.org 
[lkml]   [2013]   [Jan]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] MODSIGN: flag modules that use cryptoapi and only panic if those are unsigned
On 25.01.2013 04:20:07, +0100, Matthew Garrett <mjg59@srcf.ucam.org> wrote:

Hi Matthew,
> On Fri, Jan 25, 2013 at 12:14:54AM +0000, David Howells wrote:
>
>> You can't rely on someone trying to sneak a dodgy crypto module in to set the
>> flag when they build it. The detection thus needs to be done in the kernel
>> during the module load.
>>
>> Can you search the module image for "crypto_register_" I wonder? If that's
>> there, it's a crypto module.
>
> If you're trying to protect against malice rather than accident, what's
> going to stop the module from just finding and modifying data structures
> itself? If you want to panic if you've just loaded something that might
> compromise your crypto implementations, you've got to panic on all
> unsigned module loads.

That is the issue here. We want to protect against accidental changes
and modifications. Malicious attacks will never be caught by the FIPS
requirements where a module is allowed to check itself.

If an attacker is able to load any kind of kernel module, we have lost.
Period.

Thus, from a FIPS point of view the latest patch from Kyle is also
appropriate, provided the concerns I raised there are covered.

Ciao
Stephan


\
 
 \ /
  Last update: 2013-01-25 14:01    [W:0.046 / U:0.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site