Re: [ANNOUNCE] Release Digsig 1.5: kernel module for run-timeauthentication of binaries

[Serge E. Hallyn]

Quoting Chris Boot (bootc@xxxxxxxxx):
> On 25 Apr 2006, at 17:11, Axelle Apvrille wrote:
> 
> >- finally, note you also have choice not to sign this
> >elf loader of yours. If it isn't signed, it won't ever
> >run ;-)
> 
> Wouldn't you need to sign, say, /lib/ld-linux.so?  In that case, you  
> can simply get it to load an execute almost anything that's ELF, even  

It uses dlopen, which does mmap(PROT_EXEC), at which point digsig will
check for a signature.

If you rewrite it to not use mmap(PROT_EXEC), then the signature will
not match.  If you resign it, then you presumably know what you're
doing.

I don't see the problem in this case.

> on filesystems marked noexec, if I'm not mistaken...

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/