[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 24 Jan 2020 20:34:18 +0100
From: Solar Designer <solar@...nwall.com>
To: lkrg-users@...ts.openwall.com
Subject: Re: UMH blocked when though lkrg.block_modules = 0
Hi Patrick,
This is in addition to Adam's response.
Yes, LKRG worked as intended in this case, but it looks like its
behavior is confusing to you, so I'll clarify.
lkrg.block_modules that you mention in the Subject is completely
irrelevant to the issue you're seeing. It's blocking loading of
modules, whereas in your case LKRG is blocking invocation of a
user-space program from the kernel.
The relevant setting is lkrg.umh_lock.
On Fri, Jan 24, 2020 at 10:21:43AM +0000, Patrick Schleizer wrote:
> lkrg.umh_lock = 0
This setting is documented as follows:
-> Full lock down of the kernel's usermodehelper interface (lkrg.umh_lock).
This might break things if your distro uses UMH to invoke any programs.
Only two options are available:
0 - do NOT lock down the UMH interface fully, but allow to execute
only LKRG's whitelisted programs (default)
1 - lock down the UMH interface fully
As you can see, even the value 0 does not fully disable the UMH lock-down.
> It was probably caused by sysctl "kernel.core_pattern=|/bin/false".
Is this a distro's default? Which distro is that?
Adam, I think you might want to make two changes:
1. Add /bin/false to the whitelist.
2. Replace lkrg.umh_lock with a new sysctl called lkrg.enforce_umh with
3 possible settings: 0 to completely disable the UMH lock-down (which we
currently have no setting for), 1 same as lkrg.umh_lock = 0, and 2 same
as lkrg.umh_lock = 1. The default can be lkrg.enforce_umh = 1, which
will match the current default. This change will also bring us closer
to a consistent naming scheme and semantics of the sysctl's, which
you've just started with the recent additions to support VirtualBox.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
