Kees Cook
34e1169d99
module: add syscall to load module from fd ...
As part of the effort to create a stronger boundary between root and
kernel, Chrome OS wants to be able to enforce that kernel modules are
being loaded only from our read-only crypto-hash verified (dm_verity)
root filesystem. Since the init_module syscall hands the kernel a module
as a memory blob, no reasoning about the origin of the blob can be made.
Earlier proposals for appending signatures to kernel modules would not be
useful in Chrome OS, since it would involve adding an additional set of
keys to our kernel and builds for no good reason: we already trust the
contents of our root filesystem. We don't need to verify those kernel
modules a second time. Having to do signature checking on module loading
would slow us down and be redundant. All we need to know is where a
module is coming from so we can say yes/no to loading it.
If a file descriptor is used as the source of a kernel module, many more
things can be reasoned about. In Chrome OS's case, we could enforce that
the module lives on the filesystem we expect it to live on. In the case
of IMA (or other LSMs), it would be possible, for example, to examine
extended attributes that may contain signatures over the contents of
the module.
This introduces a new syscall (on x86), similar to init_module, that has
only two arguments. The first argument is used as a file descriptor to
the module and the second argument is a pointer to the NULL terminated
string of module arguments.
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> (merge fixes)
2012-12-14 13:05:22 +10:30
KGDB/KDB fixes and cleanups
2012-10-13 11:16:58 +09:00
perf, powerpc: Fix hw breakpoints returning -ENOSPC
2012-10-30 10:07:58 +01:00
gcov: disable CONSTRUCTORS for UML
2011-07-26 16:49:45 -07:00
irqdomain: augment add_simple() to allocate descs
2012-10-10 08:57:26 +02:00
Merge branch 'pm-qos'
2012-09-17 20:25:51 +02:00
Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2012-10-12 22:13:05 +09:00
Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2012-10-12 22:17:48 +09:00
Merge branch 'tip/perf/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace into perf/urgent
2012-10-21 19:53:34 +02:00
vfs: make path_openat take a struct filename pointer
2012-10-12 20:15:09 -04:00
[SCSI] async: make async_synchronize_full() flush all work regardless of domain
2012-07-20 09:07:37 +01:00
fs: handle failed audit_log_start properly
2012-10-09 23:33:37 -04:00
audit: optimize audit_compare_dname_path
2012-10-12 00:32:02 -04:00
audit: clean up refcounting in audit-tree
2012-08-15 12:55:22 +02:00
audit: optimize audit_compare_dname_path
2012-10-12 00:32:02 -04:00
audit: optimize audit_compare_dname_path
2012-10-12 00:32:02 -04:00
audit: make audit_inode take struct filename
2012-10-12 20:15:09 -04:00
memcg: remove direct page_cgroup-to-page pointer
2011-03-23 19:46:28 -07:00
userns: Teach inode_capable to understand inodes whose uids map to other namespaces.
2012-05-15 14:59:24 -07:00
Revert "cgroup: Remove task_lock() from cgroup_post_fork()"
2012-10-19 14:09:35 -07:00
cgroup: mark subsystems with broken hierarchy support and whine if cgroups are nested for them
2012-09-14 12:01:16 -07:00
new helper: sigsuspend()
2012-05-21 23:52:30 -04:00
kernel/configs.c: include MODULE_*() when CONFIG_IKCONFIG_PROC=n
2011-07-25 20:57:15 -07:00
CPU hotplug, debug: detect imbalance between get_online_cpus() and put_online_cpus()
2012-10-09 16:22:15 +09:00
kernel/cpu_pm.c: fix various typos
2012-05-31 17:49:27 -07:00
cpusets: Remove/update outdated comments
2012-07-24 13:53:28 +02:00
Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux
2011-11-06 19:44:47 -08:00
userns: Make credential debugging user namespace safe.
2012-08-23 22:54:18 -07:00
KVM: Steal time implementation
2011-07-14 12:59:14 +03:00
Remove all #inclusions of asm/system.h
2012-03-28 18:30:03 +01:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2012-10-02 20:25:04 -07:00
extable: Skip sorting if sorted at build time.
2012-04-19 15:06:55 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal
2012-10-10 12:02:25 +09:00
PM / Freezer: Remove references to TIF_FREEZE in comments
2012-03-04 23:08:54 +01:00
futex: avoid wake_futex() for a PI futex_q
2012-11-26 17:41:24 -08:00
futex: Mark get_robust_list as deprecated
2012-03-29 11:37:17 +02:00
userns: Convert in_group_p and in_egroup_p to use kgid_t
2012-05-03 03:29:33 -07:00
hrtimer: Update hrtimer base offsets each hrtimer_interrupt
2012-07-11 23:34:39 +02:00
hung task debugging: Inject NMI when hung and going to panic
2012-04-25 12:39:25 +02:00
irq_work: fix compile failure on tile from missing include
2012-04-13 13:15:16 -04:00
itimer: Use printk_once instead of WARN_ONCE
2012-04-10 11:00:30 +02:00
jump_label: Export jump_label_rate_limit()
2012-08-06 19:00:35 +03:00
vsprintf: fix %ps on non symbols when using kallsyms
2012-05-29 16:22:32 -07:00
syscalls, x86: add __NR_kcmp syscall
2012-05-31 17:49:32 -07:00
locking: Adjust spin lock inlining Kconfig options
2012-09-13 17:56:13 +02:00
locking/kconfig: Simplify INLINE_SPIN_UNLOCK usage
2012-03-23 13:18:57 +01:00
kdump: remove unneeded include
2012-10-06 03:05:19 +09:00
[media] kernel:kfifo: export __kfifo_max_r symbol
2012-04-11 18:24:37 -03:00
infrastructure for saner ret_from_kernel_thread semantics
2012-10-12 13:35:07 -04:00
kprobes/x86: Fix to support jprobes on ftrace-based kprobe
2012-09-13 22:52:11 -04:00
kernel: ksysfs.c is implicitly using stat.h
2011-10-31 09:20:13 -04:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal
2012-10-13 10:05:52 +09:00
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
brlocks/lglocks: turn into functions
2012-05-29 23:28:41 -04:00
lockdep: Check if nested lock is actually held
2012-09-13 17:00:44 +02:00
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
Makefile: Documentation for external tool should be correct
2012-10-25 16:00:53 -07:00
modsign: add symbol prefix to certificate list
2012-12-03 13:06:25 +10:30
MODSIGN: Move the magic string to the end of a module and eliminate the search
2012-10-19 17:30:40 -07:00
module: add syscall to load module from fd
2012-12-14 13:05:22 +10:30
module_signing: fix printk format warning
2012-10-22 08:56:34 +03:00
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
mutex: Use p->on_cpu for the adaptive spin
2011-04-14 08:52:33 +02:00
sched/rt: Use schedule_preempt_disabled()
2012-03-01 10:28:03 +01:00
mutex: Use p->on_cpu for the adaptive spin
2011-04-14 08:52:33 +02:00
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
padata: Fix cpu hotplug
2012-03-29 19:52:46 +08:00
panic: fix a possible deadlock in panic()
2012-07-30 17:25:13 -07:00
params: replace printk(KERN_<LVL>...) with pr_<lvl>(...)
2012-05-04 17:28:18 -07:00
net ip6 flowlabel: Make owner a union of struct pid * and kuid_t
2012-08-14 21:49:25 -07:00
pidns: limit the nesting depth of pid namespaces
2012-10-25 14:37:53 -07:00
[S390] cputime: add sparse checking and cleanup
2011-12-15 14:56:19 +01:00
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
printk: Fix scheduling-while-atomic problem in console_cpu_notify()
2012-10-16 18:17:44 -07:00
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
ptrace: mark __ptrace_may_access() static
2012-08-03 14:47:17 +10:00
range: fix bogus misuse of module.h to get printk()
2011-10-31 09:20:11 -04:00
rcu: Allow nesting of rcu_idle_enter() and rcu_idle_exit()
2012-02-21 09:06:12 -08:00
rcu: Add PROVE_RCU_DELAY to provoke difficult races
2012-09-23 07:42:49 -07:00
rcu: Move TINY_RCU quiescent state out of extended quiescent state
2012-09-23 07:42:52 -07:00
rcu: Move TINY_PREEMPT_RCU away from raw_local_irq_save()
2012-09-23 07:42:51 -07:00
rcu: Prevent initialization race in rcutorture kthreads
2012-09-23 07:42:23 -07:00
rcu: Grace-period initialization excludes only RCU notifier
2012-10-08 09:06:38 -07:00
rcu: Grace-period initialization excludes only RCU notifier
2012-10-08 09:06:38 -07:00
rcu: Make RCU_FAST_NO_HZ handle adaptive ticks
2012-09-26 15:44:02 +02:00
Merge remote-tracking branch 'tip/smp/hotplug' into next.2012.09.25b
2012-09-25 10:01:45 -07:00
splice: fix racy pipe->buffers uses
2012-06-13 21:16:42 +02:00
rescounters: add res_counter_uncharge_until()
2012-05-29 16:22:27 -07:00
kernel/resource.c: fix stack overflow in __reserve_region_with_split()
2012-10-06 03:05:31 +09:00
lockdep, rtmutex, bug: Show taint flags on error
2011-12-06 08:16:49 +01:00
rtmutex-tester: convert sysdev_class to a regular subsystem
2011-12-14 14:54:22 -08:00
Revert "rcu: Permit rt_mutex_unlock() with irqs disabled"
2011-12-11 10:33:18 -08:00
Remove all #inclusions of asm/system.h
2012-03-28 18:30:03 +01:00
seccomp: fix build warnings when there is no CONFIG_SECCOMP_FILTER
2012-04-18 12:24:52 +10:00
semaphore: fix improper comment reference to mutex
2012-04-05 17:15:55 -07:00
coredump: pass siginfo_t* to do_coredump() and below, not merely signr
2012-10-06 03:05:16 +09:00
smp: Remove ipi_call_lock[_irq]()/ipi_call_unlock[_irq]()
2012-06-05 17:27:14 +02:00
hotplug: Fix UP bug in smpboot hotplug code
2012-08-13 17:01:07 +02:00
smpboot: Provide infrastructure for percpu hotplug threads
2012-08-13 17:01:07 +02:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2012-10-01 10:43:39 -07:00
locking/kconfig: Simplify INLINE_SPIN_UNLOCK usage
2012-03-23 13:18:57 +01:00
workqueue: deprecate system_nrt[_freezable]_wq
2012-08-20 14:51:24 -07:00
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux
2011-11-06 19:44:47 -08:00
use clamp_t in UNAME26 fix
2012-10-19 18:51:17 -07:00
module: add syscall to load module from fd
2012-12-14 13:05:22 +10:30
Kconfig: clean up the "#if defined(arch)" list for exception-trace sysctl entry
2012-10-09 16:22:14 +09:00
mm: prepare for removal of obsolete /proc/sys/vm/nr_pdflush_threads
2012-07-31 18:42:40 -07:00
task_work: task_work_add() should not succeed after exit_task_work()
2012-09-13 16:47:34 +02:00
taskstats: cgroupstats_user_cmd() may leak on error
2012-10-06 03:05:31 +09:00
time: Move update_vsyscall definitions to timekeeper_internal.h
2012-09-24 12:38:06 -04:00
timers: Fix endless looping between cascade() and internal_add_timer()
2012-10-09 21:27:14 +02:00
static keys: Introduce 'struct static_key', static_key_true()/false() and static_key_slow_[inc|dec]()
2012-02-24 10:05:59 +01:00
userns: Convert taskstats to handle the user and pid namespaces.
2012-09-18 01:01:32 -07:00
userns: Convert setting and getting uid and gid system calls to use kuid and kgid
2012-05-03 03:28:41 -07:00
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
userns: Add kprojid_t and associated infrastructure in projid.h
2012-09-18 01:01:37 -07:00
userns: Add kprojid_t and associated infrastructure in projid.h
2012-09-18 01:01:37 -07:00
userns: Use cred->user_ns instead of cred->user->user_ns
2012-04-07 16:55:51 -07:00
Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux
2011-11-06 19:44:47 -08:00
lockdep/waitqueues: Add better annotation
2011-12-21 10:07:39 +01:00
watchdog: using u64 in get_sample_period()
2012-11-26 17:41:24 -08:00
workqueue: mod_delayed_work_on() shouldn't queue timer on 0 delay
2012-12-01 16:43:18 -08:00
34e1169d99