On Mon, 27 Nov 2017, Kees Cook wrote:
> > if (WARN_ON_ONCE(!capable(CAP_SYS_MODULE) ||
> > !capable(CAP_SYS_ADMIN) ||
> > !capable(CAP_NET_ADMIN) ||
> > !unprivileged_autoload(module_name)))
(Side note: the capable
On Mon, Nov 27, 2017 at 2:31 PM, James Morris wrote:
> On Tue, 28 Nov 2017, David Miller wrote:
>
>> From: Linus Torvalds
>> Date: Mon, 27 Nov 2017 10:41:30 -0800
>>
>> > What are the real life use-cases for normal users having modules
>> > auto-load?
>>
>> User opens SCTP socket, SCTP protocol m
On Tue, 28 Nov 2017, David Miller wrote:
> From: Linus Torvalds
> Date: Mon, 27 Nov 2017 10:41:30 -0800
>
> > What are the real life use-cases for normal users having modules
> > auto-load?
>
> User opens SCTP socket, SCTP protocol module loads.
>
> People build test cases via namespaces, and
Hi Linus,
On Mon, Nov 27, 2017 at 8:12 PM, Linus Torvalds
wrote:
> On Mon, Nov 27, 2017 at 11:02 AM, Linus Torvalds
> wrote:
>>
>> Now, the above will not necessarily work with a legacy /dev/ directory
>> where al the nodes have been pre-populated, and opening the device
>> node is supposed to l
From: Linus Torvalds
Date: Mon, 27 Nov 2017 10:41:30 -0800
> What are the real life use-cases for normal users having modules
> auto-load?
User opens SCTP socket, SCTP protocol module loads.
People build test cases via namespaces, and in that namespaces normal
users can setup virtual tunnel dev
On Mon, Nov 27, 2017 at 11:02 AM, Linus Torvalds
wrote:
>
> Now, the above will not necessarily work with a legacy /dev/ directory
> where al the nodes have been pre-populated, and opening the device
> node is supposed to load the module. So _historically_ we did indeed
> load modules as normal us
On Mon, Nov 27, 2017 at 10:41 AM, Linus Torvalds
wrote:
>
> What are the real life use-cases for normal users having modules auto-load?
Well, I could do some testing. One case is apparently both bluetoothd
and ip6tables that have been converted to indeed use CAP_NET_ADMIN.
Annoying.
Still, can'
On Mon, Nov 27, 2017 at 9:18 AM, Djalal Harouni wrote:
>
> The sysctl flag is available at "/proc/sys/kernel/modules_autoload_mode"
>
> When modules_autoload_mode is set to (0), the default, there are no
> restrictions.
So quick question: do we actually need this?
Yes, it may be the current defa
Hi List,
This is v5 of automatic module load restriction series. I have renamed
it to 'Improve Module autoloading infrastructure' for abvious reasons:
* It is more of an infrastructure change now.
* Reduce the use of word 'restriction' and use 'improving' maybe easy
to sell ?
These patches ar
