User: Password:
Subscribe / Log in / New account

KS2012: Module signing

KS2012: Module signing

Posted Sep 11, 2012 9:20 UTC (Tue) by etienne (guest, #25256)
In reply to: KS2012: Module signing by gdt
Parent article: KS2012: Module signing

> It's difficult if you cannot trust that the incoming file is reasonable.

We are talking of an header with one field indicating the offset of an array of quadruplet { offset-in-file, memory-address, size, flags }.
What is reasonable is acceptable values for what the kernel module loader uses, easily checked by your own unbreakable function.
What is generic (and re-useable) is to create another section to put a signature of everything described loadable (in flags).

If you sign the whole file (ignoring it is an ELF file), you may end up having problems of signature order (you will end up having to sign an already signed module at some point), or having to run two different PC with exactly the same distribution but different signatures.

(Log in to post comments)

Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds