From: Cyril Hrubis <chrubis@suse.cz>
To: ltp@lists.linux.it
Subject: [LTP] [PATCH 3/3] Add lockdown checks to init_module* and finit_module* tests
Date: Tue, 20 Jul 2021 14:45:56 +0200 [thread overview]
Message-ID: <YPbFhOEjYr9nOryX@yuki> (raw)
In-Reply-To: <e6033278-8e27-eed5-5f36-1dd09e68bf5a@suse.cz>
Hi!
> > I'm slightly afraid that the order of checks may change over the time
> > and we will get EPERM in all these cases, but maybe I'm just overly
> > cautious. Other than this the code looks good.
>
> I don't think we need to worry about that. With root privileges, the
> EPERM error is returned when a kernel module does not have a valid
> signature. How would something that is not even a valid kernel module in
> the first place fail that check?
>
> The only subtests that actually try to load a valid kernel module are
> null-param, invalid-param and module-exists. All three of them now
> handle lockdown correctly.
Right, we have to be able to read the signature in order to produce
EPERM and the same for the init_module() there has to be a pointer to
a module data that kernel can check the signature from.
Patch pushed, thanks.
--
Cyril Hrubis
chrubis@suse.cz
next prev parent reply other threads:[~2021-07-20 12:45 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-20 10:39 [LTP] [PATCH 1/3] Add skip_in_lockdown flag to struct tst_test Martin Doucha
2021-07-20 10:39 ` [LTP] [PATCH 2/3] Replace existing lockdown checks with skip_in_lockdown Martin Doucha
2021-07-20 11:59 ` Cyril Hrubis
2021-07-20 10:39 ` [LTP] [PATCH 3/3] Add lockdown checks to init_module* and finit_module* tests Martin Doucha
2021-07-20 12:02 ` Cyril Hrubis
2021-07-20 12:36 ` Martin Doucha
2021-07-20 12:45 ` Cyril Hrubis [this message]
2021-07-26 6:05 ` Petr Vorel
2021-07-20 11:59 ` [LTP] [PATCH 1/3] Add skip_in_lockdown flag to struct tst_test Cyril Hrubis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YPbFhOEjYr9nOryX@yuki \
--to=chrubis@suse.cz \
--cc=ltp@lists.linux.it \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.