| From e02c42d4649b1bcbf3470da8e53bb92878ab3181 Mon Sep 17 00:00:00 2001 |
| From: Kees Cook <keescook@chromium.org> |
| Date: Wed, 29 Aug 2012 11:32:09 -0700 |
| Subject: [PATCH] CHROMIUM: module: add syscall to load module from fd |
| |
| Instead of (or in addition to) kernel module signing, being able to reason |
| about the origin of a kernel module would be valuable in situations |
| where an OS already trusts a specific file system, file, etc, due to |
| things like security labels or an existing root of trust to a partition |
| through things like dm-verity. |
| |
| This introduces a new syscall (currently only on x86), similar to |
| init_module, that has only two arguments. The first argument is used as |
| a file descriptor to the module and the second argument is a pointer to |
| the NULL terminated string of module arguments. |
| |
| Signed-off-by: Kees Cook <keescook@chromium.org> |
| |
| [accepted into Rusty's modules-wip tree for linux-next: |
| http://git.kernel.org/?p=linux/kernel/git/rusty/linux.git;a=shortlog;h=refs/heads/modules-wip] |
| BUG=chromium-os:34134 |
| TEST=parrot build, manual testing |
| |
| Change-Id: I51122d61d0085ed40d2ac9b542646b28d066d5e3 |
| Reviewed-on: https://chromium-review.googlesource.com/#/c/34302 |
| Tested-by: Kees Cook <keescook@chromium.org> |
| Reviewed-by: Olof Johansson <olofj@chromium.org> |
| Commit-Ready: Kees Cook <keescook@chromium.org> |
| --- |
| arch/x86/syscalls/syscall_32.tbl | 1 + |
| arch/x86/syscalls/syscall_64.tbl | 2 + |
| include/linux/syscalls.h | 2 +- |
| kernel/module.c | 213 +++++++++++++++++++++++++++------------ |
| kernel/sys_ni.c | 1 + |
| 5 files changed, 155 insertions(+), 64 deletions(-) |
| |
| diff --git a/arch/x86/syscalls/syscall_32.tbl b/arch/x86/syscalls/syscall_32.tbl |
| index eda4e00..be92570 100644 |
| --- a/arch/x86/syscalls/syscall_32.tbl |
| +++ b/arch/x86/syscalls/syscall_32.tbl |
| @@ -355,3 +355,4 @@ |
| 346 i386 setns sys_setns |
| 347 i386 process_vm_readv sys_process_vm_readv compat_sys_process_vm_readv |
| 348 i386 process_vm_writev sys_process_vm_writev compat_sys_process_vm_writev |
| +350 i386 finit_module sys_finit_module |
| diff --git a/arch/x86/syscalls/syscall_64.tbl b/arch/x86/syscalls/syscall_64.tbl |
| index dd29a9e..4253b3f 100644 |
| --- a/arch/x86/syscalls/syscall_64.tbl |
| +++ b/arch/x86/syscalls/syscall_64.tbl |
| @@ -318,6 +318,8 @@ |
| 309 common getcpu sys_getcpu |
| 310 64 process_vm_readv sys_process_vm_readv |
| 311 64 process_vm_writev sys_process_vm_writev |
| +313 common finit_module sys_finit_module |
| + |
| # |
| # x32-specific system call numbers start at 512 to avoid cache impact |
| # for native 64-bit operation. |
| -- |
| 1.7.12.4 |
| |
