In 2001 during the 2.4 kernel development cycle, a MODULE_LICENSE macro was introduced which allows a module to explicitly declare how it is licensed. Currently there are five supported types of free software modules, "GPL", "GPL v2", "GPL and additional rights", "Dual BSD/GPL", and "Dual MPL/GPL", otherwise the kernel is considered "tainted". The include/linux/module.h header file lists three reasons for this macro: to allow users to review their license info to verify that they have a free setup, so the development community can ignore bug reports that include proprietary modules which don't release their source code, and so that vendors can do as is defined by their own policies. Further information is available in the lkml FAQ, as well as this earlier thread.

Carl Daniel Hailfinger recently reported abuse of this macro by the Linuxant consulting company. It was reported that in their modules they have defined MODULE_LICENSE as "GPL\0for files in the \"GPL\" directory; for others, only LICENSE file applies". The \0 after the word GPL was obviously added to fool the existing MODULE_LICENSE macro into thinking that this is a GPL'd module, thus allowing the module to be loaded without "tainting" the kernel.

A brief discussion followed debating how to solve for these types of abuses. Linux creator Linus Torvalds provided his own solution, also commenting, "Hey, that is interesting in itself, since playing the above kinds of games makes it pretty clear to everybody that any infringement was done wilfully. They should be talking to their lawyers about things like that."

Module support maintainer Rusty Russell [interview] acknowledged Linus' patch, however replied, "I'd prefer not to do that. Since they want to circumvent this, almost anything we want to do is a waste of time." He too offered a patch, adding to it the byline, "Arms race forces bloat upon module users."

From: Carl-Daniel Hailfinger [email blocked]
To: Rusty Russell [email blocked]
Subject: [PATCH] Blacklist binary-only modules lying about their license
Date: 	Tue, 27 Apr 2004 04:09:36 +0200

Hi,

LinuxAnt offers binary only modules without any sources. To circumvent our
MODULE_LICENSE checks LinuxAnt has inserted a "\0" into their declaration:

MODULE_LICENSE("GPL\0for files in the \"GPL\" directory; for others, only
LICENSE file applies");

Since string comparisons stop at the first "\0" character, the kernel is
tricked into thinking the modules are GPL. Btw, the "GPL" directory they
are speaking about is empty.

The attached patch blacklists all modules having "Linuxant" or "Conexant"
in their author string. This may seem a bit broad, but AFAIK both
companies never have released anything under the GPL and have a strong
history of binary-only modules.


Regards,
Carl-Daniel
-- 
http://www.hailfinger.org/

[patch]



From: Linus Torvalds [email blocked]
Subject: Re: [PATCH] Blacklist binary-only modules lying about their license
Date: 	Mon, 26 Apr 2004 21:31:52 -0700 (PDT)



On Tue, 27 Apr 2004, Carl-Daniel Hailfinger wrote:
> 
> LinuxAnt offers binary only modules without any sources. To circumvent our
> MODULE_LICENSE checks LinuxAnt has inserted a "\0" into their declaration:
> 
> MODULE_LICENSE("GPL\0for files in the \"GPL\" directory; for others, only
> LICENSE file applies");

Hey, that is interesting in itself, since playing the above kinds of games
makes it pretty clear to everybody that any infringement was done
wilfully. They should be talking to their lawyers about things like that.

Anyway, I suspect that rather than blacklist bad people, I'd much prefer
to have the module tags be done as counted strings instead. It should be
easy enough to do by just having the macro prepend a "sizeof(xxxx)"  
thing or something.

Hmm. At least with -sdt=c99 it should be trivial, with something like

	#define __MODULE_INFO(tag, name, info)		\
	static struct { int len; const char value[] }	\
	__module_cat(name,__LINE__) __attribute_used__	\
	__attribute__((section(".modinfo"),unused)) =	\
		{ sizeof(__stringify(tag) "=" info),	\
		__stringify(tag) "=" info }

doing the job.

That should make it pretty easy to parse the .modinfo section too.

		Linus



From: Rusty Russell [email blocked]
Subject: Re: [PATCH] Blacklist binary-only modules lying about their license
Date: 	Tue, 27 Apr 2004 16:04:06 +1000

On Tue, 2004-04-27 at 14:31, Linus Torvalds wrote:
> Anyway, I suspect that rather than blacklist bad people, I'd much prefer
> to have the module tags be done as counted strings instead. It should be
> easy enough to do by just having the macro prepend a "sizeof(xxxx)"  
> thing or something.
> 
> Hmm. At least with -sdt=c99 it should be trivial, with something like
> 
> 	#define __MODULE_INFO(tag, name, info)		\
> 	static struct { int len; const char value[] }	\
> 	__module_cat(name,__LINE__) __attribute_used__	\
> 	__attribute__((section(".modinfo"),unused)) =	\
> 		{ sizeof(__stringify(tag) "=" info),	\
> 		__stringify(tag) "=" info }
> 
> doing the job.

Cute, but breaks the "modinfo" tool unfortunately.  I'd prefer not to do
that.  Since they want to circumvent this, almost anything we want to do
is a waste of time.

Rusty.

Name: Stop most obvious abuse of MODULE_LICENSE
Status: Tested on 2.6.6-rc2-bk4

Arms race forces bloat upon module users.

[patch]

-- 
Anyone who quotes me in their signature is an idiot -- Rusty Russell



From: Jan-Benedict Glaw <jbglaw@lug-owl.de>
Subject: Re: [PATCH] Blacklist binary-only modules lying about their license
Date: 	Tue, 27 Apr 2004 11:21:59 +0200

Erm, that's a pure compile-time check, which the companies can remove.
So they can still put their fucked up license string into the module,
customer's kernel won't detect it.

So I'm full for embedding the supplied string's size into the module, or
some compile-time generated checksum. We need something that can be
checked at module load time, not at compile time, or do I misread the
code?

MfG, JBG

-- 
   Jan-Benedict Glaw       jbglaw@lug-owl.de    . +49-172-7608481
   "Eine Freie Meinung in  einem Freien Kopf    | Gegen Zensur | Gegen Krieg
    fuer einen Freien Staat voll Freier Bürger" | im Internet! |   im Irak!
   ret = do_actions((curr | FREE_SPEECH) & ~(NEW_COPYRIGHT_LAW | DRM | TCPA));



From: Carl-Daniel Hailfinger <c-d.hailfinger.kernel.2004@gmx.net>
Subject: Re: [PATCH] Blacklist binary-only modules lying about their license
Date: 	Tue, 27 Apr 2004 12:37:13 +0200

Jan-Benedict Glaw wrote:

> 
> Erm, that's a pure compile-time check, which the companies can remove.
> So they can still put their fucked up license string into the module,
> customer's kernel won't detect it.
> 
> So I'm full for embedding the supplied string's size into the module, or
> some compile-time generated checksum. We need something that can be
> checked at module load time, not at compile time, or do I misread the
> code?

# objdump -t forcedeth.ko |grep '\.modinfo'|sort
00000000 l    d  .modinfo       00000000
00000000 l     O .modinfo       0000000c __mod_license1618
00000020 l     O .modinfo       00000036 __mod_description1617
00000060 l     O .modinfo       00000031 __mod_author1616
000000a0 l     O .modinfo       00000047 __mod_max_interrupt_work1614
00000100 l     O .modinfo       0000002b __mod_alias58
00000140 l     O .modinfo       0000002b __mod_alias57
00000180 l     O .modinfo       0000002b __mod_alias56
000001ab l     O .modinfo       00000009 __module_depends
000001c0 l     O .modinfo       0000002d __mod_vermagic5

Wouldn't it be possible to check the length info from the module symbol
table and compare it with the strlen for the corresponding symbol? If that
gives us a mismatch, refuse to load the module (or mark it as
proprietary). Additionally, check that nothing but NULLs is used as
padding between the strings.

This way, the module format doesn't change, but we can do additional
verification in the loader.

Regards,
Carl-Daniel
-- 
http://www.hailfinger.org/



From: Paulo Marques [email blocked]
Subject: Re: [PATCH] Blacklist binary-only modules lying about their license
Date: 	Tue, 27 Apr 2004 13:59:48 +0100

Carl-Daniel Hailfinger wrote:

> 
> This way, the module format doesn't change, but we can do additional
> verification in the loader.
> 

I agree with Rusty Russell. Anything that we do can be circunvented.

If they are really into it, they can build a small tool to change the symbol 
information from the module.

The way I see it, they know a C string ends with a '\0'. This is like saying 
that a English sentence ends with a dot. If they wrote "GPL\0" they are 
effectively saying that the license *is* GPL period.

So, where the source code? :)

-- 
Paulo Marques - www.grupopie.com
"In a world without walls and fences who needs windows and gates?"



From: Jan-Benedict Glaw [email blocked]
Subject: Re: [PATCH] Blacklist binary-only modules lying about their license 
  (-> possible GPL violation :)
Date: 	Tue, 27 Apr 2004 15:12:57 +0200

On Tue, 2004-04-27 13:59:48 +0100, Paulo Marques [email blocked]
wrote in message <408E5944.8090807@grupopie.com>:
> Carl-Daniel Hailfinger wrote:
> >This way, the module format doesn't change, but we can do additional
> >verification in the loader.
> 
> The way I see it, they know a C string ends with a '\0'. This is like 
> saying that a English sentence ends with a dot. If they wrote "GPL\0" they 
> are effectively saying that the license *is* GPL period.
> 
> So, where the source code? :)

That's another (quite amusing:) point of view. Anybody willing to ask a
lawyer?

MfG, JBG

-- 
   Jan-Benedict Glaw       jbglaw@lug-owl.de    . +49-172-7608481
   "Eine Freie Meinung in  einem Freien Kopf    | Gegen Zensur | Gegen Krieg
    fuer einen Freien Staat voll Freier Bürger" | im Internet! |   im Irak!
   ret = do_actions((curr | FREE_SPEECH) & ~(NEW_COPYRIGHT_LAW | DRM | TCPA));

• Archive of above thread
• KernelTrap interview with Rusty Russell