Messages in this thread | | | From | Rusty Russell <> | Subject | Re: request_module vs. modprobe blacklist (and security subsystem implications) | Date | Sat, 24 Oct 2009 01:29:52 +1030 |
| |
On Sat, 24 Oct 2009 12:53:50 am Eric Paris wrote: > On Fri, 2009-10-23 at 19:46 +1030, Rusty Russell wrote: > > On Fri, 23 Oct 2009 01:00:22 am Eric Paris wrote: > > > > If a userspace program tries some security exploit that has been closed, do > > > > you want to warn about it? Because that seems to be the question here. > > > > > > I say yes. Knowing that malicious activity is taking place, even if it > > > didn't hurt anything is useful. > > > > Hi Eric, > > > > Your proposal is troubling for three reasons: > > > > 1) You would disable logging for things you actually want logged. > > I would?
Yep, admin disables loading of ipx to prevent hole. Now, you no longer get logging notification.
> > 2) What *actually* happens when ssh tries to load ipv6 is that > > "modprobe net-pf-10" gets called. > > 3) Containing modprobe behavior in one set of config files is really nice. > > It is it also means that we, somewhat regularly call userspace > needlessly and there is nothing an admin can do to stop it.
Yes, but that's nothing to do with SELinux; we exec modprobe for no effect. Yet I've yet to see a report that this is a performance issue. These brains are in userspace for a reason.
> But it appears you disagree that fixing that problem is worth it, and I > don't feel strongly enough to keep arguing :)
But we have learnt something, at least!
Cheers, Rusty.
| |