modsign: log module name in the event of an error
PATCH 1/1 modsign: log module name in the event of an error
Now that we have the load_info struct all initialized (including info->name, which contains the name of the module) before module_sig_check(), make the load_info struct and hence module name available to mod_verify_sig() so that we can log the module name in the event of an error.
--- kernel/module-internal.h | 26 +++++++++++++++++++++++++- kernel/module.c | 22 +--------------------- kernel/module_signing.c | 9 ++++++--- 3 files changed, 32 insertions(+), 25 deletions(-)
kernel/module-internal.h +25 -1
@@ -9,4 +9,28 @@* 2 of the Licence, or (at your option) any later version. */ -extern int mod_verify_sig (const void *mod,unsigned long *_modlen); +#include <linux/elf.h> +#include <asm/module.h> + +struct load_info { +const char *name; +/* pointer to module in temporary copy, freed at end of load_module() */ +struct module *mod; +Elf_Ehdr *hdr; +unsigned long len; +Elf_Shdr *sechdrs; +char *secstrings, *strtab; +unsigned long symoffs, stroffs; +struct _ddebug *debug; +unsigned int num_debug; +bool sig_ok; +#ifdef CONFIG_KALLSYMS +unsigned long mod_kallsyms_init_off; +#endif +struct { +unsigned int sym, str, mod, vers, info, pcpu; + } index; +}; + +extern int mod_verify_sig (const void *mod,struct load_info *info, +unsigned long *_modlen);
kernel/module.c +1 -21
@@ -307,26 +307,6 @@ int unregister_module_notifier(struct notifier_block *nb) }EXPORT_SYMBOL (unregister_module_notifier); -struct load_info { -const char *name; -/* pointer to module in temporary copy, freed at end of load_module() */ -struct module *mod; -Elf_Ehdr *hdr; -unsigned long len; -Elf_Shdr *sechdrs; -char *secstrings, *strtab; -unsigned long symoffs, stroffs; -struct _ddebug *debug; -unsigned int num_debug; -bool sig_ok; -#ifdef CONFIG_KALLSYMS -unsigned long mod_kallsyms_init_off; -#endif -struct { -unsigned int sym, str, mod, vers, info, pcpu; - } index; -}; -/* * We require a truly strong try_module_get(): 0 means success. * Otherwise an error is returned due to ongoing or failed
@@ -2778,7 +2758,7 @@ static int module_sig_check(struct load_info *info, int flags) memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {/* We truncate the module to discard the signature */ info->len -= markerlen; - err =mod_verify_sig (mod, &info->len); + err =mod_verify_sig (mod, info, &info->len); }if (!err) {
kernel/module_signing.c +6 -3
@@ -45,7 +45,8 @@ struct module_signature {/* * Verify the signature on a module. */ -int mod_verify_sig (const void *mod,unsigned long *_modlen) +int mod_verify_sig (const void *mod,struct load_info *info, +unsigned long *_modlen) {struct module_signature ms;size_t modlen = *_modlen, sig_len;
@@ -65,7 +66,8 @@ int mod_verify_sig(const void *mod, unsigned long *_modlen) *_modlen = modlen;if (ms.id_type !=PKEY_ID_PKCS7 ) { -pr_err ("Module is not signed with expected PKCS#7 message\n" ); +pr_err ("%s: Module is not signed with expected PKCS#7 message\n" , + info->name);return -ENOPKG ; }
@@ -76,7 +78,8 @@ int mod_verify_sig(const void *mod, unsigned long *_modlen) ms.__pad[0] != 0 || ms.__pad[1] != 0 || ms.__pad[2] != 0) { -pr_err ("PKCS#7 signature info has unexpected non-zero params\n" ); +pr_err ("%s: PKCS#7 signature info has unexpected non-zero params\n" , + info->name);return -EBADMSG ; }
Signature · 1 line
2.16.4
Quoted 5 lines · Jessica Yu
Now that we have the
load_infostruct all initialized (includinginfo->name, which contains the name of the module) beforemodule_sig_check(), make theload_infostruct and hence module name available tomod_verify_sig()so that we can log the module name in the event of an error.
[]
kernel/module-internal.h
Quoted 1 line
kernel/module-internal.h +0
-0
[]
kernel/module.c
Quoted 3 lines
kernel/module-internal.h +2
-0+extern int mod_verify_sig (const void *mod,struct load_info *info, +unsigned long *_modlen);kernel/module.c +0
-0
[]
kernel/module.c static int module_sig_check(struct load_info *info, int flags) · line 2761
Quoted 6 lines
kernel/module.c +1
-1@@ -2778,7 +2758,7 @@ static int module_sig_check(struct load_info *info, int flags) memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {/* We truncate the module to discard the signature */ info->len -= markerlen; - err =mod_verify_sig (mod, &info->len); + err =mod_verify_sig (mod, info, &info->len);
This is the only place this is used correct?
So why pass info and info->member?
info should be enough
+++ Joe Perches [29/06/18 21:04 -0700]:
Quoted 23 lines · Jessica Yu
Quoted 5 lines
Now that we have the
load_infostruct all initialized (includinginfo->name, which contains the name of the module) beforemodule_sig_check(), make theload_infostruct and hence module name available tomod_verify_sig()so that we can log the module name in the event of an error.[]
kernel/module-internal.h
Quoted 1 line
kernel/module-internal.h +0
-0[]
kernel/module.c
Quoted 3 lines
kernel/module-internal.h +2
-0+extern int mod_verify_sig (const void *mod,struct load_info *info, +unsigned long *_modlen);kernel/module.c +0
-0[]
kernel/module.c static int module_sig_check(struct load_info *info, int flags) · line 2761
Quoted 6 lines
kernel/module.c +1
-1@@ -2778,7 +2758,7 @@ static int module_sig_check(struct load_info *info, int flags) memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {/* We truncate the module to discard the signature */ info->len -= markerlen; - err =mod_verify_sig (mod, &info->len); + err =mod_verify_sig (mod, info, &info->len);This is the only place this is used correct?
So why pass info andinfo->member?
Quoted 1 line
info should be enough
Ah yeah you're right, thanks!
Jessica