| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 22 Oct 2009 16:26:49 +1030 From: Rusty Russell <rusty@...tcorp.com.au> To: Eric Paris <eparis@...hat.com> Cc: Alan Jenkins <sourcejedi.lkml@...glemail.com>, linux-kernel@...r.kernel.org, arjan@...radead.org, randy.dunlap@...cle.com, andi@...stfloor.org, dhowells@...hat.com, akpm@...ux-foundation.org Subject: Re: request_module vs. modprobe blacklist (and security subsystem implications) On Thu, 22 Oct 2009 05:57:28 am Eric Paris wrote: > Ah yes, not your fault though :) The problem is that SELinux reports > these denials and users get scared. We can (and now do) silence all of > these SELinux caused denials, but now we have no notification if a > malicious program tried to cause the auto loading of a module. Well, yes. I think you need to be more careful in your filtering. If a userspace program tries some security exploit that has been closed, do you want to warn about it? Because that seems to be the question here. Why should ssh not load IPv6? Because noone should? Fine, but there's a difference between "I expect it to do this but I won't let it" and "I don't expect it to do this". I think the question is bigger than modprobe.conf vs request_module. Or am I confused? Rusty. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists