Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction

From	Rusty Russell <rusty@rustcorp.com.au>
Newsgroups	linux.kernel
Subject	Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction
Date	2017-04-24 06:40 +0200
Message-ID	<tzDX3-25C-5@gated-at.bofh.it> (permalink)
References	<ty6gN-DP-3@gated-at.bofh.it> <ty6gN-DP-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Djalal Harouni <tixxdz@gmail.com> writes:
> When value is (1), task must have CAP_SYS_MODULE to be able to trigger a
> module auto-load operation, or CAP_NET_ADMIN for modules with a
> 'netdev-%s' alias.

Sorry, the magic 'netdev-' prefix is a crawling horror.  To do this
properly, you need to hand the capability (if any) from the
request_module() call.  Probably by adding a new request_module_cap and
making request_module() call that, then fixing up the callers.

Cheers,
Rusty.

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-20 00:30 +0200
  Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-20 00:40 +0200
  Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-20 01:20 +0200
    Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-20 01:50 +0200
      Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-20 04:50 +0200
        Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-22 01:20 +0200
          Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@amacapital.net> - 2017-04-22 01:30 +0200
            Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-22 01:50 +0200
              Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-22 02:00 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-22 02:20 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-22 03:30 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-22 09:00 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-22 21:30 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-24 16:30 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-24 20:10 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-24 20:40 +0200
            Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Casey Schaufler <casey@schaufler-ca.com> - 2017-04-22 02:00 +0200
              Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-22 02:10 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Casey Schaufler <casey@schaufler-ca.com> - 2017-04-22 02:20 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@amacapital.net> - 2017-04-22 08:50 +0200
            Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-22 14:20 +0200
  Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction Rusty Russell <rusty@rustcorp.com.au> - 2017-04-24 06:40 +0200

csiph-web