On Thu, Mar 8, 2018 at 7:06 PM, Linus Torvalds
[off-list ref] wrote:
So I don't like Andy's "let's make it a kernel module and then that
kernel module can execve() a blob". THAT seems like just stupid
indirection.
But I do like Andy's "execve a blob" part, because it is the *blob*
that has had its signature verified, not the file!
To be honest., Andy's approach has the advantage that all the
synchronization we do for modules still works.
In particular, we have module loading logic where we synchronize
loading of modules with the same name, so that two things that do
request_module() concurrently will not lead to two modules being
loaded.
See that whole "module_mutex" thing, and the logic in (for example)
"add_unformed_module()".
Andrei's patch short-circuits the module loading before that, so if
you have two concurrent request_module() calls, you'll end up with no
serialization, and two executables.
So maybe Andy is right. He often is, after all.
Linus