summaryrefslogtreecommitdiffstats
path: root/kernel/sys_ni.c
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2012-10-16 07:31:07 +1030
committerRusty Russell <rusty@rustcorp.com.au>2012-12-14 13:05:22 +1030
commit34e1169d996ab148490c01b65b4ee371cf8ffba2 (patch)
tree3380af46682ce4396c1524bdba8badcab8a51046 /kernel/sys_ni.c
parent84ecfd15f5547c992c901df6ec14b4d507eb2c6e (diff)
downloadlinux-stable-34e1169d996ab148490c01b65b4ee371cf8ffba2.tar.gz
linux-stable-34e1169d996ab148490c01b65b4ee371cf8ffba2.tar.bz2
linux-stable-34e1169d996ab148490c01b65b4ee371cf8ffba2.zip
module: add syscall to load module from fd
As part of the effort to create a stronger boundary between root and kernel, Chrome OS wants to be able to enforce that kernel modules are being loaded only from our read-only crypto-hash verified (dm_verity) root filesystem. Since the init_module syscall hands the kernel a module as a memory blob, no reasoning about the origin of the blob can be made. Earlier proposals for appending signatures to kernel modules would not be useful in Chrome OS, since it would involve adding an additional set of keys to our kernel and builds for no good reason: we already trust the contents of our root filesystem. We don't need to verify those kernel modules a second time. Having to do signature checking on module loading would slow us down and be redundant. All we need to know is where a module is coming from so we can say yes/no to loading it. If a file descriptor is used as the source of a kernel module, many more things can be reasoned about. In Chrome OS's case, we could enforce that the module lives on the filesystem we expect it to live on. In the case of IMA (or other LSMs), it would be possible, for example, to examine extended attributes that may contain signatures over the contents of the module. This introduces a new syscall (on x86), similar to init_module, that has only two arguments. The first argument is used as a file descriptor to the module and the second argument is a pointer to the NULL terminated string of module arguments. Signed-off-by: Kees Cook <keescook@chromium.org> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> (merge fixes)
Diffstat (limited to 'kernel/sys_ni.c')
-rw-r--r--kernel/sys_ni.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index dbff751e4086..395084d4ce16 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -25,6 +25,7 @@ cond_syscall(sys_swapoff);
cond_syscall(sys_kexec_load);
cond_syscall(compat_sys_kexec_load);
cond_syscall(sys_init_module);
+cond_syscall(sys_finit_module);
cond_syscall(sys_delete_module);
cond_syscall(sys_socketpair);
cond_syscall(sys_bind);