grsecurity forums

Kernel reports "3.0.6-1 SMP mod_unload 686 CONSTIFY_PLUGIN GRSEC ".

Is there any reason for placing CONSTIFY_PLUGIN in this magic string?

I mean why constified kernel shouldn't be able to load non-constified modules? (It should work fine, just no protection for modules - right?)

arekm wrote:I mean why constified kernel shouldn't be able to load non-constified modules? (It should work fine, just no protection for modules - right?)

no, it would not work right . imagine that the external module tries to write to an ops structure that is writable under a normal kernel, but read-only on a constified kernel. if the module is compiled without the consitify plugin, you'll get a nice runtime oops when it actually tries to write to this ops structure vs. a compile time error when you can easily see what it's trying to do and patch it appropriately.

Bad then, have to disable constify - patching external modules is too big pain :-/ Or drop constify from magic string and pray that external modules don't write in these places.

One way or another - it's a mess.

Upstream constify thing as soon as possible is a solution !