Messages in this thread | | | Subject | Re: [PATCH v2] net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules | From | Eric Paris <> | Date | Thu, 24 Mar 2011 14:03:53 -0400 |
| |
On Thu, 2011-03-24 at 10:37 -0500, Serge E. Hallyn wrote: > Quoting Eric Paris (eparis@parisplace.org): > > On Tue, Mar 1, 2011 at 4:33 PM, Vasiliy Kulikov <segoon@openwall.com> wrote: > ... > > This patch is causing a bit of a problem in Fedora. The problem lies > > Sorry, what exactly is the problem it is causing? I gather it's > spitting out printks? What exactly do the printks say? The patch > included at bottom checks for CAP_NET_ADMIN before checking for > CAP_SYS_MODULE, so these must be cases which historically always > quietly failed, and are now hitting the 'pr_err' which this patch > adds?
Not quite. SELinux logs every time an operation is denied. This patch means that every time a module is requested which does not exist as netdev-* we check CAP_SYS_MODULE. SELinux does not allow CAP_SYS_MODULE and thus we get SELinux complaining that tasks are trying to load modules. I do have one report from a user who claims this is breaking his system, but I'm not sure I believe him as I have yet to see any dmesg printk from the pr_err.
On my local system reproduce the SELinux denials on every boot as something tries to autoload "reg", "wifi0", and "virbr0". I have no modules which match these. Thus the first try for CAP_NET_ADMIN +netdev-wifi0 fails. We then hit the CAP_SYS_MODULE check which SELinux rejects and puts up a huge warning that someone is trying to load code into the kernel. Big red flags. Even in permissive, where the capable(CAP_SYS_MODULE) passes, we won't hit the pr_err() since there is not module for "wifi"
I think there are 3 possibilities:
Change SELinux policy so as to not complain when udev/NM/libvirt try to check CAP_SYS_MODULE, but that's a bad idea, since if they every try to use init_module(2) we won't get denials.
Change this callsite to a _noaudit check. Which is better than above but still not great since we wouldn't get a denial log if anybody had tried to load xfs....
Figure out a way to stop the calls to "reg" "wifi0" and "virbr0" if they don't exist.
I feel like the last one is the best way, but I don't know what a solution could look like....
| |