On Mon, Dec 19, 2022 at 3:23 PM Luis Chamberlain <mcgrof@xxxxxxxxxx> wrote: > > On Mon, Dec 19, 2022 at 02:46:18PM -0600, Allen Webb wrote: > > Update the documentation to include the presense and use case of > > modules.builtin.alias. > > > > Signed-off-by: Allen Webb <allenwebb@xxxxxxxxxx> > > --- > > Documentation/kbuild/kbuild.rst | 6 ++++++ > > 1 file changed, 6 insertions(+) > > > > diff --git a/Documentation/kbuild/kbuild.rst b/Documentation/kbuild/kbuild.rst > > index 08f575e6236c..1c7c02040a54 100644 > > --- a/Documentation/kbuild/kbuild.rst > > +++ b/Documentation/kbuild/kbuild.rst > > @@ -17,6 +17,12 @@ modules.builtin > > This file lists all modules that are built into the kernel. This is used > > by modprobe to not fail when trying to load something builtin. > > > > +modules.builtin.alias > > +--------------------- > > +This file lists all match-id based aliases for modules built into the kernel. > > +These are intended to enable userspace to make authorization decisions based > > +on which modules are likely to be bound to a device after it is authorized. > > What is an example? This sounds obscure. Many of the devices that match the usb_storage driver only specify the vendor id, product id, and device id (VID:PID:D) and do not match against device class, interface class, etc. Here are some examples from modules.alias: A grep for wildcards in these fields yields 6136 matches: grep 'dc\*dsc\*dp\*ic\*isc\*ip\*in\*' /lib/modules/5.19.11-1rodete1-amd64/modules.alias | wc -l 6136 To write USBGuard policy that only authorizes devices that bind to a particular module the policy needs to be aware of all these VID:PID:D which can change between kernel versions. This is done at runtime rather than excluding modules from the build because some devices are not needed at or before login or when a device is locked. By not authorizing new devices that would bind to a set of modules, these modules become unreachable to an attacker who seeks to exploit kernel bugs in those modules. I could add this detail to the documentation file, but I was trying to keep the description to about the same length as the others around it. > > Luis
