[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 20 Apr 2017 03:22:22 +0100
From: Ben Hutchings <ben@...adent.org.uk>
To: Djalal Harouni <tixxdz@...il.com>, Linux Kernel Mailing List
<linux-kernel@...r.kernel.org>, Andy Lutomirski <luto@...nel.org>, Kees
Cook <keescook@...omium.org>, Andrew Morton <akpm@...ux-foundation.org>,
serge@...lyn.com, kernel-hardening@...ts.openwall.com,
linux-security-module@...r.kernel.org
Cc: Linux API <linux-api@...r.kernel.org>, Dongsu Park <dpark@...teo.net>,
Casey Schaufler <casey@...aufler-ca.com>, James Morris
<james.l.morris@...cle.com>, Paul Moore <paul@...l-moore.com>, Tetsuo
Handa <penguin-kernel@...ove.SAKURA.ne.jp>, Greg Kroah-Hartman
<gregkh@...uxfoundation.org>, Jonathan Corbet <corbet@....net>, Jessica Yu
<jeyu@...hat.com>, Rusty Russell <rusty@...tcorp.com.au>, Arnaldo Carvalho
de Melo <acme@...hat.com>, Mauro Carvalho Chehab <mchehab@...nel.org>, Ingo
Molnar <mingo@...nel.org>, zendyani@...il.com, Peter Zijlstra
<peterz@...radead.org>
Subject: Re: [PATCH v3 1/2] modules:capabilities: automatic module loading
restriction
On Thu, 2017-04-20 at 00:20 +0200, Djalal Harouni wrote:
[...]
> +modules_autoload:
> +
> +A sysctl to control if modules auto-load feature is allowed or not.
> +This sysctl complements "modules_disabled" which is for all module
> +operations where this flag applies only to automatic module loading.
> +Automatic module loading happens when programs request a kernel feature
> +that is implemented by an unloaded module, the kernel automatically
> +runs the program pointed by "modprobe" sysctl in order to load the
> +corresponding module.
> +
> +When modules_autoload is set to (0), the default, there are no
> +restrictions.
> +
> +When modules_autoload is set to (1), processes must have CAP_SYS_MODULE
> +to be able to trigger a module auto-load operation, or CAP_NET_ADMIN
> +for modules with a 'netdev-%s' alias.
> +
> +When modules_autoload is set to (2), automatic module loading is
> +disabled for all. Once set, this value can not be changed.
I would expect a parameter 'modules_autoload' to be a boolean, so this
behaviour would be surprising.
What is the point of mode 2? Why would someone want to set
modules_disabled=0 and modules_autoload=2?
[...]
> --- a/kernel/module.c
> +++ b/kernel/module.c
[...]
> +static int modules_autoload_privileged_access(const char *name)
> +{
> + if (capable(CAP_SYS_MODULE))
> + return 0;
> + else if (name && strstr(name, "netdev-") && capable(CAP_NET_ADMIN))
[...]
We want a prefix match, so use strncmp() not strstr().
Ben.
--
Ben Hutchings
It is easier to change the specification to fit the program than vice
versa.
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
