linux-kernel - Re: [PATCH 2/2] x86: Allow disabling of sys_iopl, sys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 18 Jul 2011 01:19:05 +0200
From:	Eric Paris <eparis@...isplace.org>
To:	Mike Waychison <mikew@...gle.com>
Cc:	"Andrew G. Morgan" <agm@...gle.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Greg Kroah-Hartman <gregkh@...e.de>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, x86@...nel.org,
	linux-kernel@...r.kernel.org, Klibc mailing list <klibc@...or.com>
Subject: Re: [PATCH 2/2] x86: Allow disabling of sys_iopl, sys_ioperm

On Sat, Jul 16, 2011 at 12:42 AM, Mike Waychison <mikew@...gle.com> wrote:
> On Fri, Jul 15, 2011 at 3:30 PM, Andrew G. Morgan <agm@...gle.com> wrote:
>> I'd put it in kinit too.
>>
>> I think you may have to think about the call_usermodehelper code, and
>> you might want to look at dropping CAP_SYS_MODULE too.
>
> Looks like usermodehelpers are configurable for both the inheritable
> set and the bounding set via /proc/sys/kernel/usermodehelper/bset and
> /proc/sys/kernel/usermodehelper/inheritable thanks to Eric Paris
> (17f60a7da, available in 3.0-rc1).

If you look in Fedora and RHEL you'll see that we actually already
provide a dracut module (dracut-caps) which can be used to create an
initrd which contains all of the modules you need to load, it loads
them, and then will drop all of the caps that you want to drop.   Good
to see we already solved this problem once!!  (although it requires
that your kernel and initrd not be in a place that your root user can
modify it, easy to do in the virt space, no so easy in the real
hardware world)

-Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/