Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction

From	Kees Cook <keescook@chromium.org>
Newsgroups	linux.kernel
Subject	Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction
Date	2017-04-20 01:50 +0200
Message-ID	<ty7we-1ki-13@gated-at.bofh.it> (permalink)
References	<ty6gN-DP-3@gated-at.bofh.it> <ty6gN-DP-1@gated-at.bofh.it> <ty73c-1b1-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, Apr 19, 2017 at 4:15 PM, Andy Lutomirski <luto@kernel.org> wrote:
> On Wed, Apr 19, 2017 at 3:20 PM, Djalal Harouni <tixxdz@gmail.com> wrote:
>> +/* Sets task's modules_autoload */
>> +static inline int task_set_modules_autoload(struct task_struct *task,
>> +                                           unsigned long value)
>> +{
>> +       if (value > MODULES_AUTOLOAD_DISABLED)
>> +               return -EINVAL;
>> +       else if (task->modules_autoload > value)
>> +               return -EPERM;
>> +       else if (task->modules_autoload < value)
>> +               task->modules_autoload = value;
>> +
>> +       return 0;
>> +}
>
> This needs to be more locked down.  Otherwise someone could set this
> and then run a setuid program.  Admittedly, it would be quite odd if
> this particular thing causes a problem, but the issue exists
> nonetheless.

Eeeh, I don't agree this needs to be changed. APIs provided by modules
are different than the existing privilege-manipulation syscalls this
concern stems from. Applications are already forced to deal with
things being missing like this in the face of it simply not being
built into the kernel.

Having to hide this behind nnp seems like it'd reduce its utility...

-Kees

-- 
Kees Cook
Pixel Security

Thread

[PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-20 00:30 +0200
  Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-20 00:40 +0200
  Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-20 01:20 +0200
    Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-20 01:50 +0200
      Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-20 04:50 +0200
        Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-22 01:20 +0200
          Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@amacapital.net> - 2017-04-22 01:30 +0200
            Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-22 01:50 +0200
              Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-22 02:00 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-22 02:20 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-22 03:30 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-22 09:00 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-22 21:30 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-24 16:30 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-24 20:10 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-24 20:40 +0200
            Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Casey Schaufler <casey@schaufler-ca.com> - 2017-04-22 02:00 +0200
              Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-22 02:10 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Casey Schaufler <casey@schaufler-ca.com> - 2017-04-22 02:20 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@amacapital.net> - 2017-04-22 08:50 +0200
            Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-22 14:20 +0200
  Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction Rusty Russell <rusty@rustcorp.com.au> - 2017-04-24 06:40 +0200

csiph-web