lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Mon, 15 Aug 2022 10:33:28 +0200
From:   Vegard Nossum <>
To:     Kees Cook <>
        Thadeu Lima de Souza Cascardo <>,
        Serge Hallyn <>,
        Eric Biederman <>,, John Haxby <>
Subject: Re: [PATCH] capabilities: new kernel.ns_modules_allowed sysctl

On 8/12/22 20:48, Kees Cook wrote:
> On Wed, Aug 10, 2022 at 10:25:17AM +0200, Vegard Nossum wrote:
>> On 8/10/22 00:56, Kees Cook wrote:
>>> On Tue, Aug 09, 2022 at 08:52:29PM +0200, Vegard Nossum wrote:
>>>> Creating a new user namespace grants you the ability to reach a lot of code
>>>> (including loading certain kernel modules) that would otherwise be out of
>>>> reach of an attacker. We can reduce the attack surface and block exploits
>>>> by ensuring that user namespaces cannot trigger module (auto-)loading.


> I agree, it'd be nice to have. I'm just trying to predict what kind of
> push-back there may be.
> Can you address the build failures noted on the thread, and send a v2?

Did just now:

> I
> note that after this patch it looks like all module loading from a userns
> gets logged, regardless of the setting. Is that intended?

Yeah, I thought it was useful to know even when the sysctl was disabled
but I've removed it in v2 so the patch is less intrusive. I guess it can
always be added later if it actually serves a purpose.



Powered by blists - more mailing lists