Groups > linux.kernel > #1641954

Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE

From	David Miller <davem@davemloft.net>
Newsgroups	linux.kernel
Subject	Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE
Date	2017-05-15 20:20 +0200
Message-ID	<tHsL7-3ax-1@gated-at.bofh.it> (permalink)
References	<tHhwl-4kQ-1@gated-at.bofh.it> <tHoHv-sA-5@gated-at.bofh.it> <tHsBs-37u-27@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

From: Mahesh Bandewar (महेश बंडेवार) <maheshb@google.com>
Date: Mon, 15 May 2017 10:59:55 -0700

> The current behavior is already breaking things. e.g. unprivileged
> process can be root inside it's own user-ns. This will allow it to
> create IPtable rules causing contracking module to be loaded in
> default-ns affecting every flow on the server (not just the namespace
> that user or an unprivileged process is attached to). Cases that I
> mentioned above are just the tip of an iceberg.

Yes, that is certainly undesirable.

But is it really a module loading problem?  Perhaps we need to look
more deeply into how conntract behaves by default wrt. namespaces.

If we've given the user the ability to be root in his or her own
namespace, then we should let them do root stuff in there.

The only problem is when "doing root stuff in there" has an
undesirable impact upon the rest of the system.

And that's needs to be looked into on a facility by facility basis,
rather then just sprinkling "no module loading" test here and there,
or even unconditionally.

Thread

[PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Mahesh Bandewar <mahesh@bandewar.net> - 2017-05-13 01:30 +0200
  Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-14 12:50 +0200
    Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE ebiederm@xmission.com (Eric W. Biederman) - 2017-05-14 16:10 +0200
      Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-15 08:20 +0200
        Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE David Miller <davem@davemloft.net> - 2017-05-15 16:00 +0200
          Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Mahesh Bandewar (महेश बंडेवार)          <maheshb@google.com> - 2017-05-15 20:10 +0200
            Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE David Miller <davem@davemloft.net> - 2017-05-15 20:20 +0200
            Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE ebiederm@xmission.com (Eric W. Biederman) - 2017-05-15 20:30 +0200
              Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE Florian Westphal <fw@strlen.de> - 2017-05-15 22:10 +0200
    Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Mahesh Bandewar (महेश बंडेवार)          <maheshb@google.com> - 2017-05-15 04:50 +0200
      Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-15 08:20 +0200
      Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Eric Dumazet <edumazet@google.com> - 2017-05-15 15:20 +0200
        Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Kees Cook <keescook@chromium.org> - 2017-05-15 19:10 +0200
      Re: [PATCH] kmod: don't load module unless req process has  CAP_SYS_MODULE David Miller <davem@davemloft.net> - 2017-05-15 15:50 +0200

csiph-web