Designate the "MODULE_${modname}" symbol namespace to mean: 'only
export to the named module'.

Notably, explicit imports of anything in the "MODULE_" space is
forbidden. Modules implicitly get the "MODULE_${modname}" namespace
added.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
---
 kernel/module/main.c  |   28 ++++++++++++++++++++++++++--
 scripts/mod/modpost.c |    5 +++++
 2 files changed, 31 insertions(+), 2 deletions(-)

--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -1070,6 +1070,13 @@ static int verify_namespace_is_imported(
 
 	namespace = kernel_symbol_namespace(sym);
 	if (namespace && namespace[0]) {
+		/*
+		 * Implicitly import MODULE_${mod->name} namespace.
+		 */
+		if (strncmp(namespace, "MODULE_", 7) == 0 &&
+		    strcmp(namespace+7, mod->name) == 0)
+			return 0;
+
 		for_each_modinfo_entry(imported_namespace, info, "import_ns") {
 			if (strcmp(namespace, imported_namespace) == 0)
 				return 0;
@@ -1613,15 +1620,30 @@ static void module_license_taint_check(s
 	}
 }
 
-static void setup_modinfo(struct module *mod, struct load_info *info)
+static int setup_modinfo(struct module *mod, struct load_info *info)
 {
 	struct module_attribute *attr;
+	char *imported_namespace;
 	int i;
 
 	for (i = 0; (attr = modinfo_attrs[i]); i++) {
 		if (attr->setup)
 			attr->setup(mod, get_modinfo(info, attr->attr.name));
 	}
+
+	for_each_modinfo_entry(imported_namespace, info, "import_ns") {
+		/*
+		 * 'MODULE_' prefixed namespaces are implicit, disallow
+		 * explicit imports.
+		 */
+		if (strstarts(imported_namespace, "MODULE_")) {
+			pr_err("%s: module tries to import module namespace: %s\n",
+			       mod->name, imported_namespace);
+			return -EPERM;
+		}
+	}
+
+	return 0;
 }
 
 static void free_modinfo(struct module *mod)
@@ -2935,7 +2957,9 @@ static int load_module(struct load_info
 		goto free_unload;
 
 	/* Set up MODINFO_ATTR fields */
-	setup_modinfo(mod, info);
+	err = setup_modinfo(mod, info);
+	if (err)
+		goto free_modinfo;
 
 	/* Fix up syms, so that st_value is a pointer to location. */
 	err = simplify_symbols(mod, info);
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1565,6 +1565,7 @@ static const char *mod_basename(const ch
 
 static void read_symbols(const char *modname)
 {
+	char module_namespace[MODULE_NAME_LEN + 8];
 	const char *symname;
 	char *version;
 	char *license;
@@ -1600,6 +1601,10 @@ static void read_symbols(const char *mod
 		     namespace = get_next_modinfo(&info, "import_ns", namespace))
 			add_namespace(&mod->imported_namespaces, namespace);
 
+		snprintf(module_namespace, sizeof(module_namespace), "MODULE_%s",
+			 mod_basename(mod->name));
+		add_namespace(&mod->imported_namespaces, module_namespace);
+
 		if (extra_warn && !get_modinfo(&info, "description"))
 			warn("missing MODULE_DESCRIPTION() in %s\n", modname);
 	}

On Tue, Dec 3, 2024 at 12:11 AM Peter Zijlstra <peterz@infradead.org> wrote:
>
> Designate the "MODULE_${modname}" symbol namespace to mean: 'only
> export to the named module'.
>
> Notably, explicit imports of anything in the "MODULE_" space is
> forbidden. Modules implicitly get the "MODULE_${modname}" namespace
> added.
>
> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> ---
>  kernel/module/main.c  |   28 ++++++++++++++++++++++++++--
>  scripts/mod/modpost.c |    5 +++++
>  2 files changed, 31 insertions(+), 2 deletions(-)
>
> --- a/kernel/module/main.c
> +++ b/kernel/module/main.c
> @@ -1070,6 +1070,13 @@ static int verify_namespace_is_imported(
>
>         namespace = kernel_symbol_namespace(sym);
>         if (namespace && namespace[0]) {
> +               /*
> +                * Implicitly import MODULE_${mod->name} namespace.
> +                */
> +               if (strncmp(namespace, "MODULE_", 7) == 0 &&

strncmp() -> strstarts()

> +                   strcmp(namespace+7, mod->name) == 0)
> +                       return 0;
> +


You can add verify_module_namespace() in this commit
with a simple implementation.

static bool verify_module_namespace(const char *namespace, const char *modname)
{
        const char *prefix = "module:";

        return strstarts(namespace, prefix) &&
                  !strcmp(namespace + strlen(prefix), modname);
}


Then, you can extend it in the next commit,
to support the glob pattern in verify_module_namespace()






> --- a/scripts/mod/modpost.c
> +++ b/scripts/mod/modpost.c
> @@ -1565,6 +1565,7 @@ static const char *mod_basename(const ch
>
>  static void read_symbols(const char *modname)
>  {
> +       char module_namespace[MODULE_NAME_LEN + 8];
>         const char *symname;
>         char *version;
>         char *license;
> @@ -1600,6 +1601,10 @@ static void read_symbols(const char *mod
>                      namespace = get_next_modinfo(&info, "import_ns", namespace))
>                         add_namespace(&mod->imported_namespaces, namespace);
>
> +               snprintf(module_namespace, sizeof(module_namespace), "MODULE_%s",
> +                        mod_basename(mod->name));
> +               add_namespace(&mod->imported_namespaces, module_namespace);
> +
>                 if (extra_warn && !get_modinfo(&info, "description"))
>                         warn("missing MODULE_DESCRIPTION() in %s\n", modname);
>         }


This is a noise change, as you immediately remove this code in the next commit.

So, I recommend adding verify_module_namespace() in this commit.
Then, you can extend it in the next commit for glob pattern support.







index d4abcd8ee2ed..58fbcb6bb718 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1674,6 +1674,14 @@ void buf_write(struct buffer *buf, const char
*s, int len)
        buf->pos += len;
 }

+static bool verify_module_namespace(const char *namespace, const char *modname)
+{
+       const char *prefix = "module:";
+
+       return strstarts(namespace, prefix) &&
+               !strcmp(namespace + strlen(prefix), modname);
+}
+
 static void check_exports(struct module *mod)
 {
        struct symbol *s, *exp;
@@ -1701,7 +1709,8 @@ static void check_exports(struct module *mod)

                basename = mod_basename(mod->name);

-               if (!contains_namespace(&mod->imported_namespaces,
exp->namespace)) {
+               if (!verify_module_namespace(exp->namespace, mod->name) &&
+                   !contains_namespace(&mod->imported_namespaces,
exp->namespace)) {
                        modpost_log(!allow_missing_ns_imports,
                                    "module %s uses symbol %s from
namespace %s, but does not import it.\n",
                                    basename, exp->name, exp->namespace);








--
Best Regards
Masahiro Yamada