Date: Sun, 6 Mar 2011 16:14:58 -0500 From: Steve Grubb <sgrubb@...hat.com> To: oss-security@...ts.openwall.com Cc: Vasiliy Kulikov <segoon@...nwall.com> Subject: Re: kernel: modules_disabled policy On Saturday, March 05, 2011 11:16:43 am Vasiliy Kulikov wrote: > Is it possible to implement strict do-not-touch-the-kernel policy for > root via disabling LKM loading and _all_ other indirect places with write > access that allows root to do something, but being too relaxed and > allows to write to [almost] arbitrary kernel location? This would make > root the Boss Of Userland, but as to the kernel it would be but just a > privileged client. Or such policy would be incomplete and there is > almost always a way to by-pass it due to the system design? There's been some discussion on this here: http://marc.info/?l=linux-security-module&m=129613936129293&w=2 As root, you could modify /etc/modprobe.d/ and add your root kit and issue a system reboot. That might get attention, but its possible to load modules by rebooting. Along the same lines, you could regenerate the initramfs with your module being loaded there. What was proposed was another kind of deployment module where the initramfs and kernel is on readonly media so any kernel updates have no effect. The initramfs has all the kernel modules that wil ever be loaded and anything that manages to live in /lib/modules will not be used for anything. Since root is in control of user space, he could change any program that the kernel calls out to load modules. So in the initramfs we want to drop 2 capabilities so that all kernel helpers are not able to run with CAP_SYS_MODULE or CAP_SYS_RAWIO. There are lots of loose ends. I think you found another place where root in the traditional sense was perfectly fine doing a snapshot. But if you want to allow anyone to have root, but not be able to get arbitrary code running at ring0, there will be quite a bit of looking for these uncontrolled places and getting them under some capability check that can be excluded without diminishing roots abilities too much. -Steve
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.