[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.LRH.2.20.1702031159120.3285@namei.org>
Date: Fri, 3 Feb 2017 12:02:55 +1100 (AEDT)
From: James Morris <jmorris@...ei.org>
To: Djalal Harouni <tixxdz@...il.com>
cc: linux-kernel@...r.kernel.org, kernel-hardening@...ts.openwall.com,
linux-security-module@...r.kernel.org,
Kees Cook <keescook@...omium.org>,
Andrew Morton <akpm@...ux-foundation.org>,
Lafcadio Wluiki <wluikil@...il.com>, Dongsu Park <dongsu@...ocode.com>,
Andy Lutomirski <luto@...nel.org>,
James Morris <james.l.morris@...cle.com>, serge@...lyn.com,
Al Viro <viro@...iv.linux.org.uk>, Daniel Mack <daniel@...que.org>,
Jann Horn <jann@...jh.net>,
Elena Reshetova <elena.reshetova@...el.com>
Subject: Re: [RFC/PATCH 2/3] security: Add the Timgad module
On Thu, 2 Feb 2017, Djalal Harouni wrote:
> *) The per-process prctl() settings are:
> prctl(PR_TIMGAD_OPTS, PR_TIGMAD_SET_MOD_RESTRICT, value, 0, 0)
>
> Where value means:
>
> 0 - Classic module load and unload permissions, nothing changes.
>
> 1 - The current process must have CAP_SYS_MODULE to be able to load and
> unload modules. CAP_NET_ADMIN should allow the current process to
> load and unload only netdev aliased modules, not implemented
>
> 2 - Current process can not loaded nor unloaded modules.
>
> *) sysctl interface supports the followin values:
>
> 0 - Classic module load and unload permissions, nothing changes.
>
> 1 - Only privileged processes with CAP_SYS_MODULE should be able to load and
> unload modules.
>
> To be added: processes with CAP_NET_ADMIN should be able to
> load and unload only netdev aliased modules, this is currently not
> supported. Other checks for real root without CAP_SYS_MODULE ? ...
>
> (This should be improved)
>
> 2 - Modules can not be loaded nor unloaded. Once set, this sysctl value
> cannot be changed.
How is this different to just using CAP_SYS_MODULE?
--
James Morris
<jmorris@...ei.org>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
