Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1640802

[PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE

Show all headers | View raw

From: Mahesh Bandewar <maheshb@google.com>

A process inside random user-ns should not load a module, which is
currently possible. As demonstrated in following scenario -

  Create namespaces; especially a user-ns and become root inside.
  $ unshare -rfUp -- unshare -unm -- bash

  Try to load the bridge module. It should fail and this is expected!
  #  modprobe bridge
  WARNING: Error inserting stp (/lib/modules/4.11.0-smp-DEV/kernel/net/802/stp.ko): Operation not permitted
  FATAL: Error inserting bridge (/lib/modules/4.11.0-smp-DEV/kernel/net/bridge/bridge.ko): Operation not permitted

  Verify bridge module is not loaded.
  # lsmod | grep bridge
  #

  Now try to create a bridge inside this newly created net-ns which would
  mean bridge module need to be loaded.
  # ip link add br0 type bridge
  # echo $?
  0
  # lsmod | grep bridge
  bridge                110592  0
  stp                    16384  1 bridge
  llc                    16384  2 bridge,stp
  #

  After this patch -
  # ip link add br0 type bridge
  RTNETLINK answers: Operation not supported
  # echo $?
  2
  # lsmod | grep bridge
  #

Signed-off-by: Mahesh Bandewar <maheshb@google.com>
---
 kernel/kmod.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/kmod.c b/kernel/kmod.c
index 563f97e2be36..ac30157169b7 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -133,6 +133,9 @@ int __request_module(bool wait, const char *fmt, ...)
 #define MAX_KMOD_CONCURRENT 50	/* Completely arbitrary value - KAO */
 	static int kmod_loop_msg;
 
+	if (!capable(CAP_SYS_MODULE))
+		return -EPERM;
+
 	/*
 	 * We don't allow synchronous module loading from async.  Module
 	 * init may invoke async_synchronize_full() which will end up
-- 
2.13.0.rc2.291.g57267f2277-goog

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Mahesh Bandewar <mahesh@bandewar.net> - 2017-05-13 01:30 +0200
  Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-14 12:50 +0200
    Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE ebiederm@xmission.com (Eric W. Biederman) - 2017-05-14 16:10 +0200
      Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-15 08:20 +0200
        Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE David Miller <davem@davemloft.net> - 2017-05-15 16:00 +0200
          Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Mahesh Bandewar (महेश बंडेवार)          <maheshb@google.com> - 2017-05-15 20:10 +0200
            Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE David Miller <davem@davemloft.net> - 2017-05-15 20:20 +0200
            Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE ebiederm@xmission.com (Eric W. Biederman) - 2017-05-15 20:30 +0200
              Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE Florian Westphal <fw@strlen.de> - 2017-05-15 22:10 +0200
    Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Mahesh Bandewar (महेश बंडेवार)          <maheshb@google.com> - 2017-05-15 04:50 +0200
      Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-15 08:20 +0200
      Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Eric Dumazet <edumazet@google.com> - 2017-05-15 15:20 +0200
        Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Kees Cook <keescook@chromium.org> - 2017-05-15 19:10 +0200
      Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE David Miller <davem@davemloft.net> - 2017-05-15 15:50 +0200

csiph-web