[refpolicy] [PATCH] ifconfig loads kernel modules

[refpolicy] [PATCH] ifconfig loads kernel modules

[Russell Coker]

The following patch allows ifconfig to trigger module loads.


diff -ruN /home/rjc/src/pol-git/policy/modules/system/sysnetwork.te ./policy/modules/system/sysnetwork.te
--- /home/rjc/src/pol-git/policy/modules/system/sysnetwork.te	2016-07-28 20:33:39.971961928 +1000
+++ ./policy/modules/system/sysnetwork.te	2016-07-31 19:47:25.822898970 +1000
@@ -261,6 +261,7 @@
 # Ifconfig local policy
 #
 
+kernel_load_module(ifconfig_t)
 allow ifconfig_t self:capability { net_raw net_admin sys_admin sys_tty_config };
 allow ifconfig_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack };
 allow ifconfig_t self:fd use;

[refpolicy] [PATCH] ifconfig loads kernel modules

[Chris PeBenito]

On 07/31/16 05:48, Russell Coker wrote:
> The following patch allows ifconfig to trigger module loads.
>
>
> diff -ruN /home/rjc/src/pol-git/policy/modules/system/sysnetwork.te ./policy/modules/system/sysnetwork.te
> --- /home/rjc/src/pol-git/policy/modules/system/sysnetwork.te	2016-07-28 20:33:39.971961928 +1000
> +++ ./policy/modules/system/sysnetwork.te	2016-07-31 19:47:25.822898970 +1000
> @@ -261,6 +261,7 @@
>  # Ifconfig local policy
>  #
>
> +kernel_load_module(ifconfig_t)
>  allow ifconfig_t self:capability { net_raw net_admin sys_admin sys_tty_config };
>  allow ifconfig_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack };
>  allow ifconfig_t self:fd use;

Is this a current denial?  If so, what version of net-tools is that on?

ifconfig_t already has kernel_request_load_module(ifconfig_t) so I'm 
unclear why it would be directly loading modules itself.

-- 
Chris PeBenito

[refpolicy] [PATCH] ifconfig loads kernel modules

[Russell Coker]

On Wed, 3 Aug 2016 09:38:02 AM Chris PeBenito wrote:
> > +kernel_load_module(ifconfig_t)
> >
> >  allow ifconfig_t self:capability { net_raw net_admin sys_admin
> >sys_tty_config }; allow ifconfig_t self:process ~{ ptrace setcurrent
> >setexec setfscreate setrlimit execmem execheap execstack }; allow
> >ifconfig_t self:fd use;
> 
> Is this a current denial?  If so, what version of net-tools is that on?
> 
> ifconfig_t already has kernel_request_load_module(ifconfig_t) so I'm 
> unclear why it would be directly loading modules itself.

It's been in my tree for years.  I'll remove it and see what happens.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

[refpolicy] [PATCH] ifconfig loads kernel modules

[Jason Zaman]

On Wed, Aug 03, 2016 at 12:28:53PM +1000, Russell Coker wrote:
> On Wed, 3 Aug 2016 09:38:02 AM Chris PeBenito wrote:
> > > +kernel_load_module(ifconfig_t)
> > >
> > >  allow ifconfig_t self:capability { net_raw net_admin sys_admin
> > >sys_tty_config }; allow ifconfig_t self:process ~{ ptrace setcurrent
> > >setexec setfscreate setrlimit execmem execheap execstack }; allow
> > >ifconfig_t self:fd use;
> > 
> > Is this a current denial?  If so, what version of net-tools is that on?
> > 
> > ifconfig_t already has kernel_request_load_module(ifconfig_t) so I'm 
> > unclear why it would be directly loading modules itself.
> 
> It's been in my tree for years.  I'll remove it and see what happens.

I've seen this on my gentoo machines for a fair while too but not dug
deeper into why. I assumed it was something to do with firmware loading
when the wifi modules come up but could be completely wrong. I think I
only see it during first boot tho not later on.

-- Jason
> 
> -- 
> My Main Blog         http://etbe.coker.com.au/
> My Documents Blog    http://doc.coker.com.au/
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy