On Thu, Sep 05, 2019 at 02:16:51PM +0200, Miroslav Benes wrote: > > > > A full demo would require packaging up replacement .ko's with a livepatch, as > > > > well as "blacklisting" those deprecated .kos, etc. But that's all I had time > > > > to cook up last week before our holiday weekend here. > > > > > > Frankly, I'm not sure about this approach. I'm kind of torn. The current > > > solution is far from ideal, but I'm not excited about the other options > > > either. It seems like the choice is basically between "general but > > > technically complicated fragile solution with nontrivial maintenance > > > burden", or "something safer and maybe cleaner, but limiting for > > > users/distros". Of course it depends on whether the limitation is even > > > real and how big it is. Unfortunately we cannot quantify it much and that > > > is probably why our opinions (in the email thread) differ. > > > > How would this option be "limiting for users/distros"? If the packaging > > part of the solution is done correctly then I don't see how it would be > > limiting. > > I'll try to explain my worries. > > Blacklisting first. Yes, I agree that it would make things a lot simpler, > but I am afraid it would not fly at SUSE. Petr meanwhile explained > elsewhere, but I don't think we can limit our customers that much. We > perceive live patching as a product as much transparent as possible and as > less intrusive as possible. One thing is to forbid to remove a module, the > other is to forbid its loading. > > We could warn the admin. Something like "there is a fix for a module foo, > which is not loaded currently. It will not be patched and the system will > be still vulnerable if you load the module unless a new fixed version is > provided." No. We just distribute the new .ko with the livepatch. It should be transparent to the user. > Yes, we can distribute the new version of .ko with a livepatch. What is > the reason for blacklisting then? I don't probably understand, but either > a module is loaded and we can patch it (without late module patching), or > it is not and we could replace .ko on disk. I think the blacklisting is a failsafe to prevent the old module from accidentally getting loaded after patching. > Now, I don't think that replacing .ko on disk is a good idea. We've > already discussed it. It would lead to a maintenance/packaging problem, > because you never know which version of the module is loaded in the > system. The state space grows rather rapidly there. What exactly are your concerns? Either the old version of the module is loaded, and it's livepatched; or the new version of the module is loaded, and it's not livepatched. Anyway that could be reported to the user somehow, e.g. report srcversion in sysfs. -- Josh
