Message-ID: <1504044122.4448.24.camel@decadent.org.uk>
Subject: Re: Allow automatic kernel taint on unsigned module load to be
 disabled
From: Ben Hutchings <ben@decadent.org.uk>
To: Matthew Garrett <mjg59@google.com>, Jessica Yu <jeyu@kernel.org>
Cc: linux-kernel@vger.kernel.org, Rusty Russell <rusty@rustcorp.com.au>
Date: Tue, 29 Aug 2017 23:02:02 +0100
In-Reply-To: <CACdnJutWdHi5YOG1Mn0vZwTmZyQHyyABeZ0caNn2rJCYehCGhg@mail.gmail.com>
References: <20170804180751.14896-1-mjg59@google.com>
         <20170810204328.kk4lbj4hvednmofw@redbean>
         <CACdnJusrO0rThxt0ikapFVWtJZVaiYj8AJ_oFOczskRKS4fVpA@mail.gmail.com>
         <20170829175647.ej5fqszss2mbpc5i@redbean>
         <CACdnJutWdHi5YOG1Mn0vZwTmZyQHyyABeZ0caNn2rJCYehCGhg@mail.gmail.com>
Content-Type: multipart/signed; micalg="pgp-sha512";
        protocol="application/pgp-signature"; boundary="=-S+hqZhznpPz5td5gA4LQ"
Mime-Version: 1.0
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 2934
Lines: 67


--=-S+hqZhznpPz5td5gA4LQ
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, 2017-08-29 at 13:22 -0700, Matthew Garrett wrote:
> > On Tue, Aug 29, 2017 at 10:56 AM, Jessica Yu <jeyu@kernel.org> wrote:
> > I understand what the patch is doing, what I don't yet understand is
> > _why_ you would want to remove the unsigned module taint when
> > CONFIG_MODULE_SIG is enabled. Which distributions are asking for this
> > exactly, and for what use cases? I find it a bit contradictory to have
> > CONFIG_MODULE_SIG enabled and at the same time expect the kernel to
> > behave as if the option wasn't enabled.
>=20
> Debian disable CONFIG_MODULE_SIG because of this additional taint
> (I've Cc:ed Ben who made this change).

The current state of affairs is that Debian doesn't have the mechanism
in place to sign modules with a trusted key.  If we were to allow third
parties to add signatures in some way (I think that's what Matthew's
interested in doing) we would have to enabled CONFIG_MODULE_SIG, but
that would cause modules to be tainted by default.

> > I would really prefer not to add extra code to remove what is cosmetic
> > and still has informational/debug value. If the unsigned module taint
> > is for whatever reason that bothersome, why can't distro(s) carry a
> > 2-line patch removing the message and taint for those particular
> > setups where signatures are considered "irrelevant" even with
> > CONFIG_MODULE_SIG=3Dy?
>=20
> If it's functionality that distributions want to patch out, it makes
> sense to provide them with a config option rather than forcing them to
> maintain a patch separately.

We could use this in Debian.  It would likely be a temporary stage
until we do our own centralised module signing (or someone implements a
Merkle tree for in-tree modules).

Ben.

--=20
Ben Hutchings
Teamwork is essential - it allows you to blame someone else.


--=-S+hqZhznpPz5td5gA4LQ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAlml5FsACgkQ57/I7JWG
EQn9Qw//d8vOViV7jez2hNyR8HvVaAiaxQeXfz1s0tivuaGVgokWVuqWOGVWSbKu
gWyVOQe0L7vENMB1NAbHnjiM1+Rm6d5f5EIHr9m3plqhNO0Qe88s880VO+BB4tR/
VWDO0+dQZ97RyzRslVHb5uZA/3SM0muDhYrYfrGYEck4TF+JrEsAfOsbxdkQ/PhE
0QpjNEh8aqawk3skURgpJCNPi4HXUAfUL+HuT8H8L767nnHm8Z1Xiz2uBSh7tL+9
17bSSDGqmJTYJ2AHvIn5fz8gTcvDZ+wKTqA5hrAxGei/OQRL9ppVW6Fxaub5Q6x1
/5PaWgl8iscPs24CE9CHzyTjUIR8rOhtnRR0dbmjdEGBQcOPSVVzRAX0qKNL9vR+
mM8QIACTe0q/Zz7nNKGhJvH8GyVEI+Tnv/9sM4WcMis4+ayGT6tQpHDLd76b4E0R
WMX6yvCwqtJsuVVtHSmwfbmIlEWOBE5T71aArWsKUTPr2WLAg2Ge2DqcyTfmRSEz
47RbCOXlRMKrAJ4BlV/hz8r3vO41oBXFDqOUY4Q54YUZ/9MVAEdET+OD8sq/ufnr
QGnH0GRT+ZfzKHiWbh4r1yARDZBzVV+lD/qhyEAnfZha55q/3sPZteW68uewQcn3
3sBNCN+jbkGGgrh0MX0hVyVMe+ZLAlNlegWB7ODWn6SGyugW2Tg=
=1Js2
-----END PGP SIGNATURE-----

--=-S+hqZhznpPz5td5gA4LQ--