From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753148AbdK0XqN (ORCPT ); Mon, 27 Nov 2017 18:46:13 -0500 Received: from userp1040.oracle.com ([156.151.31.81]:31249 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752357AbdK0XqL (ORCPT ); Mon, 27 Nov 2017 18:46:11 -0500 Date: Tue, 28 Nov 2017 10:44:52 +1100 (AEDT) From: James Morris X-X-Sender: james.l.morris@localhost To: Kees Cook cc: Linus Torvalds , David Miller , Djalal Harouni , Andy Lutomirski , Andrew Morton , "Luis R. Rodriguez" , Ben Hutchings , Solar Designer , "Serge E. Hallyn" , Jessica Yu , Rusty Russell , LKML , linux-security-module , kernel-hardening@lists.openwall.com, Jonathan Corbet , Ingo Molnar , Network Development , Peter Zijlstra Subject: Re: [PATCH v5 next 0/5] Improve Module autoloading infrastructure In-Reply-To: Message-ID: References: <1511803118-2552-1-git-send-email-tixxdz@gmail.com> <20171128.041426.801732093971324601.davem@davemloft.net> User-Agent: Alpine 2.20 (LFD 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-Source-IP: aserv0022.oracle.com [141.146.126.234] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 27 Nov 2017, Kees Cook wrote: > > if (WARN_ON_ONCE(!capable(CAP_SYS_MODULE) || > > !capable(CAP_SYS_ADMIN) || > > !capable(CAP_NET_ADMIN) || > > !unprivileged_autoload(module_name))) (Side note: the capable() calls would ideally come after the whitelist check). > We have some of this already with the module prefixes. Doing this > per-module would need to be exported to userspace, I think. It'd be > way too fragile sitting in the kernel. What about writing a whitelist to /proc (per-task) or /sys/fs (global) ? The per-task whitelist is inherited from the global one by default, or from a parent process if it's been modified in the parent. -- James Morris From mboxrd@z Thu Jan 1 00:00:00 1970 From: james.l.morris@oracle.com (James Morris) Date: Tue, 28 Nov 2017 10:44:52 +1100 (AEDT) Subject: [PATCH v5 next 0/5] Improve Module autoloading infrastructure In-Reply-To: References: <1511803118-2552-1-git-send-email-tixxdz@gmail.com> <20171128.041426.801732093971324601.davem@davemloft.net> Message-ID: To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org On Mon, 27 Nov 2017, Kees Cook wrote: > > if (WARN_ON_ONCE(!capable(CAP_SYS_MODULE) || > > !capable(CAP_SYS_ADMIN) || > > !capable(CAP_NET_ADMIN) || > > !unprivileged_autoload(module_name))) (Side note: the capable() calls would ideally come after the whitelist check). > We have some of this already with the module prefixes. Doing this > per-module would need to be exported to userspace, I think. It'd be > way too fragile sitting in the kernel. What about writing a whitelist to /proc (per-task) or /sys/fs (global) ? The per-task whitelist is inherited from the global one by default, or from a parent process if it's been modified in the parent. -- James Morris -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Tue, 28 Nov 2017 10:44:52 +1100 (AEDT) From: James Morris In-Reply-To: Message-ID: References: <1511803118-2552-1-git-send-email-tixxdz@gmail.com> <20171128.041426.801732093971324601.davem@davemloft.net> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Subject: [kernel-hardening] Re: [PATCH v5 next 0/5] Improve Module autoloading infrastructure To: Kees Cook Cc: Linus Torvalds , David Miller , Djalal Harouni , Andy Lutomirski , Andrew Morton , "Luis R. Rodriguez" , Ben Hutchings , Solar Designer , "Serge E. Hallyn" , Jessica Yu , Rusty Russell , LKML , linux-security-module , kernel-hardening@lists.openwall.com, Jonathan Corbet , Ingo Molnar , Network Development , Peter Zijlstra List-ID: On Mon, 27 Nov 2017, Kees Cook wrote: > > if (WARN_ON_ONCE(!capable(CAP_SYS_MODULE) || > > !capable(CAP_SYS_ADMIN) || > > !capable(CAP_NET_ADMIN) || > > !unprivileged_autoload(module_name))) (Side note: the capable() calls would ideally come after the whitelist check). > We have some of this already with the module prefixes. Doing this > per-module would need to be exported to userspace, I think. It'd be > way too fragile sitting in the kernel. What about writing a whitelist to /proc (per-task) or /sys/fs (global) ? The per-task whitelist is inherited from the global one by default, or from a parent process if it's been modified in the parent. -- James Morris