Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE

From	David Miller <davem@davemloft.net>
Newsgroups	linux.kernel
Subject	Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE
Date	2017-05-15 16:00 +0200
Message-ID	<tHoHv-sA-5@gated-at.bofh.it> (permalink)
References	<tGZg5-ux-3@gated-at.bofh.it> <tH2nD-2yc-1@gated-at.bofh.it> <tHhwl-4kQ-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 15 May 2017 08:10:59 +0200

> On Sun, May 14, 2017 at 08:57:34AM -0500, Eric W. Biederman wrote:
>> Greg Kroah-Hartman <gregkh@linuxfoundation.org> writes:
>> 
>> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
>> index bcb0f610ee42..6b72528a4636 100644
>> --- a/net/core/rtnetlink.c
>> +++ b/net/core/rtnetlink.c
>> @@ -2595,7 +2595,7 @@ static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
>>  
>>                 if (!ops) {
>>  #ifdef CONFIG_MODULES
>> -                       if (kind[0]) {
>> +                       if (kind[0] && capable(CAP_NET_ADMIN)) {
>>                                 __rtnl_unlock();
>>                                 request_module("rtnl-link-%s", kind);
>>                                 rtnl_lock();
> 
> I don't object to this if the networking developers don't mind the
> change in functionality.  They can handle the fallout :)

As I've said in another email, I am pretty sure this can break things.

Thread

[PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Mahesh Bandewar <mahesh@bandewar.net> - 2017-05-13 01:30 +0200
  Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-14 12:50 +0200
    Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE ebiederm@xmission.com (Eric W. Biederman) - 2017-05-14 16:10 +0200
      Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-15 08:20 +0200
        Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE David Miller <davem@davemloft.net> - 2017-05-15 16:00 +0200
          Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Mahesh Bandewar (महेश बंडेवार)          <maheshb@google.com> - 2017-05-15 20:10 +0200
            Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE David Miller <davem@davemloft.net> - 2017-05-15 20:20 +0200
            Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE ebiederm@xmission.com (Eric W. Biederman) - 2017-05-15 20:30 +0200
              Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE Florian Westphal <fw@strlen.de> - 2017-05-15 22:10 +0200
    Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Mahesh Bandewar (महेश बंडेवार)          <maheshb@google.com> - 2017-05-15 04:50 +0200
      Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-15 08:20 +0200
      Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Eric Dumazet <edumazet@google.com> - 2017-05-15 15:20 +0200
        Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Kees Cook <keescook@chromium.org> - 2017-05-15 19:10 +0200
      Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE David Miller <davem@davemloft.net> - 2017-05-15 15:50 +0200

csiph-web