From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759805AbdEVNtX (ORCPT ); Mon, 22 May 2017 09:49:23 -0400 Received: from mail-qk0-f194.google.com ([209.85.220.194]:35699 "EHLO mail-qk0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751525AbdEVNtR (ORCPT ); Mon, 22 May 2017 09:49:17 -0400 MIME-Version: 1.0 In-Reply-To: <20170522120848.GA3003@openwall.com> References: <1495454226-10027-1-git-send-email-tixxdz@gmail.com> <20170522120848.GA3003@openwall.com> From: Djalal Harouni Date: Mon, 22 May 2017 15:49:15 +0200 Message-ID: Subject: Re: [kernel-hardening] [PATCH v4 next 0/3] modules: automatic module loading restrictions To: Solar Designer Cc: linux-kernel , netdev@vger.kernel.org, LSM List , kernel-hardening@lists.openwall.com, Andy Lutomirski , Kees Cook , Andrew Morton , Rusty Russell , "Serge E. Hallyn" , Jessica Yu , "David S. Miller" , James Morris , Paul Moore , Stephen Smalley , Greg Kroah-Hartman , Tetsuo Handa , Ingo Molnar , Linux API , Dongsu Park , Casey Schaufler , Jonathan Corbet , Arnaldo Carvalho de Melo , Mauro Carvalho Chehab , Peter Zijlstra , Zendyani , "open list:DOCUMENTATION" , Al Viro , Ben Hutchings Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Alexander, On Mon, May 22, 2017 at 2:08 PM, Solar Designer wrote: > Hi Djalal, > > Thank you for your work on this! > > On Mon, May 22, 2017 at 01:57:03PM +0200, Djalal Harouni wrote: >> *) When modules_autoload_mode is set to (2), automatic module loading is >> disabled for all. Once set, this value can not be changed. > > What purpose does this securelevel-like property ("Once set, this value > can not be changed.") serve here? I think this mode 2 is needed, but > without this extra property, which is bypassable by e.g. explicitly > loaded kernel modules anyway (and that's OK). My reasoning about "Once set, this value can not be changed" is mainly for: If you have some systems where modules are not updated for any given reason, then the only one who will be able to load a module is an administrator, basically this is a shortcut for: * Apps/services can run with CAP_NET_ADMIN but they are not allowed to auto-load 'netdev' modules. * Explicitly loading modules can be guarded by seccomp filters *per* app, so even if these apps have CAP_SYS_MODULE they won't be able to explicitly load modules, one has to remount some sysctl /proc/ entries read-only here and remove CAP_SYS_ADMIN for all apps anyway. This mainly serves the purpose of these systems that do not receive updates, if I don't want to expose those kernel interfaces what should I do ? then if I want to unload old versions and replace them with new ones what operation should be allowed ? and only real root of the system can do it. Hence, the "Once set, this value can not be changed" is more of a shortcut, also the idea was put in my mind based on how "modules_disabled" is disabled forever, and some other interfaces. I would say: it is easy to handle a transition from 1) "hey this system is still up to date, some features should be exposed" to 2) "this system is not up to date anymore, only root should expose some features..." Hmm, I am not sure if this answers your question ? :-) I definitively don't want to fall into "modules_disabled" trap where is it too strict! "Once set, this value can not be changed" means for some users do not set it otherwise the system is unusable... Maybe an extra "4" mode for that ? better get it right. Thanks! -- tixxdz