lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 15 Aug 2022 10:33:28 +0200 From: Vegard Nossum <vegard.nossum@...cle.com> To: Kees Cook <keescook@...omium.org> Cc: linux-kernel@...r.kernel.org, Thadeu Lima de Souza Cascardo <cascardo@...onical.com>, Serge Hallyn <serge@...lyn.com>, Eric Biederman <ebiederm@...ssion.com>, linux-hardening@...r.kernel.org, John Haxby <john.haxby@...cle.com> Subject: Re: [PATCH] capabilities: new kernel.ns_modules_allowed sysctl On 8/12/22 20:48, Kees Cook wrote: > On Wed, Aug 10, 2022 at 10:25:17AM +0200, Vegard Nossum wrote: >> >> On 8/10/22 00:56, Kees Cook wrote: >>> On Tue, Aug 09, 2022 at 08:52:29PM +0200, Vegard Nossum wrote: >>>> Creating a new user namespace grants you the ability to reach a lot of code >>>> (including loading certain kernel modules) that would otherwise be out of >>>> reach of an attacker. We can reduce the attack surface and block exploits >>>> by ensuring that user namespaces cannot trigger module (auto-)loading. >>>> [...] > I agree, it'd be nice to have. I'm just trying to predict what kind of > push-back there may be. > > Can you address the build failures noted on the thread, and send a v2? Did just now: https://lore.kernel.org/all/20220815082753.6088-1-vegard.nossum@oracle.com/ > I > note that after this patch it looks like all module loading from a userns > gets logged, regardless of the setting. Is that intended? Yeah, I thought it was useful to know even when the sysctl was disabled but I've removed it in v2 so the patch is less intrusive. I guess it can always be added later if it actually serves a purpose. Thanks, Vegard
Powered by blists - more mailing lists