Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1626920

Re: [PATCH v3 1/2] modules:capabilities: automatic module loading restriction

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Thu, 2017-04-20 at 00:20 +0200, Djalal Harouni wrote:
[...] 
> +modules_autoload:
> +
> +A sysctl to control if modules auto-load feature is allowed or not.
> +This sysctl complements "modules_disabled" which is for all module
> +operations where this flag applies only to automatic module loading.
> +Automatic module loading happens when programs request a kernel feature
> +that is implemented by an unloaded module, the kernel automatically
> +runs the program pointed by "modprobe" sysctl in order to load the
> +corresponding module.
> +
> +When modules_autoload is set to (0), the default, there are no
> +restrictions.
> +
> +When modules_autoload is set to (1), processes must have CAP_SYS_MODULE
> +to be able to trigger a module auto-load operation, or CAP_NET_ADMIN
> +for modules with a 'netdev-%s' alias.
> +
> +When modules_autoload is set to (2), automatic module loading is
> +disabled for all. Once set, this value can not be changed.

I would expect a parameter 'modules_autoload' to be a boolean, so this
behaviour would be surprising.

What is the point of mode 2?  Why would someone want to set
modules_disabled=0 and modules_autoload=2?

[...]
> --- a/kernel/module.c
> +++ b/kernel/module.c
[...]
> +static int modules_autoload_privileged_access(const char *name)
> +{
> +	if (capable(CAP_SYS_MODULE))
> +		return 0;
> +	else if (name && strstr(name, "netdev-") && capable(CAP_NET_ADMIN))
[...]

We want a prefix match, so use strncmp() not strstr().

Ben.

-- 
Ben Hutchings
It is easier to change the specification to fit the program than vice
versa.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v3 1/2] modules:capabilities: automatic module loading restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-20 00:30 +0200
  Re: [PATCH v3 1/2] modules:capabilities: automatic module loading restriction Andy Lutomirski <luto@kernel.org> - 2017-04-20 01:20 +0200
  Re: [PATCH v3 1/2] modules:capabilities: automatic module loading  restriction Ben Hutchings <ben@decadent.org.uk> - 2017-04-20 04:30 +0200
    Re: [kernel-hardening] Re: [PATCH v3 1/2] modules:capabilities:  automatic module loading restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-20 14:50 +0200
      Re: [kernel-hardening] Re: [PATCH v3 1/2] modules:capabilities:  automatic module loading restriction Ben Hutchings <ben@decadent.org.uk> - 2017-04-20 17:10 +0200
        Re: [kernel-hardening] Re: [PATCH v3 1/2] modules:capabilities:  automatic module loading restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-20 22:40 +0200
          Re: [kernel-hardening] Re: [PATCH v3 1/2] modules:capabilities:  automatic module loading restriction Kees Cook <keescook@chromium.org> - 2017-04-20 23:40 +0200

csiph-web