Messages in this thread | | | Date | Thu, 13 Aug 2009 09:03:06 -0500 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH 2/3] security: introducing security_request_module |
| |
Quoting Eric Paris (eparis@redhat.com): > Calling request_module() will trigger a userspace upcall which will load a > new module into the kernel. This can be a dangerous event if the process > able to trigger request_module() is able to control either the modprobe > binary or the module binary. This patch adds a new security hook to > request_module() which can be used by an LSM to control a processes ability > to call request_module().
Is there a specific case in which you'd want to deny this ability from a real task?
-serge
| |