Vivek Goyal <vgoyal at redhat.com> writes: > On Thu, Nov 08, 2012 at 02:40:50PM -0500, Vivek Goyal wrote: >> On Tue, Nov 06, 2012 at 03:51:59PM -0800, Eric W. Biederman wrote: >> >> [..] >> >> Thnking more about executable signature verification, I have another question. >> >> While verifyign the signature, we will have to read the whole executable >> in memory. That sounds bad as we are in kernel mode and will not be killed >> and if sombody is trying to execute a malformed exceptionally large >> executable, system will start killing other processess. We can potentially >> lock all the memory in kernel just by trying to execute a signed huge >> executable. Not good. >> > > Also, even if we try to read in whole executable, can't an hacker modify > pages in swap disk and then they will be faulted back in and bingo hacker > is running its unsigned code. (assuming root has been compromised otherwise > why do we have to do all this exercise). You make a decent case for an implicit mlockall(MCL_FUTURE) being required of signed executables, that are going to be granted privileges based on signature verification. As for size if the executable won't fit in memory, there is no point in checking the signature. It should be fairly straight forward to make the signature checking process preemptable and killable. Of course this is all hand waving at this point. Eric
