lkml.org 
[lkml]   [2017]   [May]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [kernel-hardening] [PATCH v4 next 0/3] modules: automatic module loading restrictions
    Hi Alexander,

    On Mon, May 22, 2017 at 2:08 PM, Solar Designer <solar@openwall.com> wrote:
    > Hi Djalal,
    >
    > Thank you for your work on this!
    >
    > On Mon, May 22, 2017 at 01:57:03PM +0200, Djalal Harouni wrote:
    >> *) When modules_autoload_mode is set to (2), automatic module loading is
    >> disabled for all. Once set, this value can not be changed.
    >
    > What purpose does this securelevel-like property ("Once set, this value
    > can not be changed.") serve here? I think this mode 2 is needed, but
    > without this extra property, which is bypassable by e.g. explicitly
    > loaded kernel modules anyway (and that's OK).

    My reasoning about "Once set, this value can not be changed" is mainly for:

    If you have some systems where modules are not updated for any given
    reason, then the only one who will be able to load a module is an
    administrator, basically this is a shortcut for:

    * Apps/services can run with CAP_NET_ADMIN but they are not allowed to
    auto-load 'netdev' modules.

    * Explicitly loading modules can be guarded by seccomp filters *per*
    app, so even if these apps have
    CAP_SYS_MODULE they won't be able to explicitly load modules, one
    has to remount some sysctl /proc/ entries read-only here and remove
    CAP_SYS_ADMIN for all apps anyway.

    This mainly serves the purpose of these systems that do not receive
    updates, if I don't want to expose those kernel interfaces what should
    I do ? then if I want to unload old versions and replace them with new
    ones what operation should be allowed ? and only real root of the
    system can do it. Hence, the "Once set, this value can not be changed"
    is more of a shortcut, also the idea was put in my mind based on how
    "modules_disabled" is disabled forever, and some other interfaces. I
    would say: it is easy to handle a transition from 1) "hey this system
    is still up to date, some features should be exposed" to 2) "this
    system is not up to date anymore, only root should expose some
    features..."

    Hmm, I am not sure if this answers your question ? :-)

    I definitively don't want to fall into "modules_disabled" trap where
    is it too strict! "Once set, this value can not be changed" means for
    some users do not set it otherwise the system is unusable...

    Maybe an extra "4" mode for that ? better get it right.

    Thanks!

    --
    tixxdz

    \
     
     \ /
      Last update: 2017-05-22 15:50    [W:3.698 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site