lkml.org 
[lkml]   [1999]   [Jun]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Potential future capabilities hole!!

On Tue, 8 Jun 1999, David Luyer wrote:

> > Hi,
> >
> > I just noticed that the kernel executes "modprobe" with _all_ capabilities
> > raised.
>
> You're seriously considering enabling module autoloading a secure system?

No, not really.

However, someone might disable module loading by revoking the relevant
capabilities from the entire system (rather than compiling out module
loading). You might say this is foolish, but there are reasons to do this
- perhaps "init" is privileged with passworded access, for those occasions
when new modules are required.

Given the above situation, it is dangerous to issue _all_ capabilities to
a userland program (modprobe) which may be subverted.

Put another way, if I have a shell with various capabilities permantently
revoked (RAW_IO, MODULE, etc), then insmod is not available to me. However
I can open /dev/something, and cause a program with _all_ capabilities to
act on my behalf. I offered several ways of subverting that program in my
previous mail.

Chris


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:52    [W:0.231 / U:5.200 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site