linux-kernel - Re: [PATCH] power: disable hibernation if module loading is disabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 4 Mar 2011 22:21:02 +0100
From:	"Rafael J. Wysocki" <rjw@...k.pl>
To:	Vasiliy Kulikov <segoon@...nwall.com>
Cc:	linux-kernel@...r.kernel.org, security@...nel.org,
	Len Brown <len.brown@...el.com>, Pavel Machek <pavel@....cz>,
	linux-pm@...ts.linux-foundation.org
Subject: Re: [PATCH] power: disable hibernation if module loading is disabled

On Friday, March 04, 2011, Vasiliy Kulikov wrote:
> On Fri, Mar 04, 2011 at 21:42 +0100, Rafael J. Wysocki wrote:
> > That "everyone" is actually the "full root" (in the case of /sys/power/state)
> > or someone having CAP_SYS_ADMIN in the /dev/snapshot case, right?
> 
> Yes, sorry for my bad english.  "Everyone" is indeed misleading :-D
> 
> > Second, there's _zero_ relationship between /proc/sys/kernel/modules_disabled
> > and the hibernation interface, so please find a different way to solve the
> > problem (if there is any).
> 
> If modules_disabled is set to 1, then nobody, even full root may not write
> to the kernel, right?  So, if something permits to indirectly pass
> modules_disabled restriction, this is a bug.  Otherwise,
> modules_disabled is confusing as it gives false sense of security.
> 
> -OR-
> 
> modules_disabled's documentation should be changed to note that it
> doesn't prevent rootkit uploading, but only forbids modprob'ing modules
> via the "official" init_module(2) gate, disallowing e.g. module autoloading.

Why not to change that documentation, then?

Also, please note that in order to "write" into memory using the hibernation
interface you need to have write access to swap, which you can use to corrupt
memory regardless of the modules_disabled setting AFAICS.

Thanks,
Rafael
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/