linux-hardening - Re: Per-process flag set via prctl() to deny module loading?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 10 Apr 2023 23:47:16 +0300
From:   Topi Miettinen <toiwoton@...il.com>
To:     Tycho Andersen <tycho@...ho.pizza>
Cc:     linux-modules <linux-modules@...r.kernel.org>,
        Kernel Hardening <kernel-hardening@...ts.openwall.com>,
        "linux-hardening@...r.kernel.org" <linux-hardening@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: Per-process flag set via prctl() to deny module loading?

On 10.4.2023 16.36, Tycho Andersen wrote:
> On Mon, Apr 10, 2023 at 01:06:00PM +0300, Topi Miettinen wrote:
>> I'd propose to add a per-process flag to irrevocably deny any loading of
>> kernel modules for the process and its children. The flag could be set (but
>> not unset) via prctl() and for unprivileged processes, only when
>> NoNewPrivileges is also set. This would be similar to CAP_SYS_MODULE, but
>> unlike capabilities, there would be no issues with namespaces since the flag
>> isn't namespaced.
>>
>> The implementation should be very simple.
>>
>> Preferably the flag, when configured, would be set by systemd, Firejail and
>> maybe also container managers. The expectation would be that the permission
>> to load modules would be retained only by udev and where SUID needs to be
>> allowed (NoNewPrivileges unset).
> 
> You can do something like this today via STATIC_USERMODEHELPER without
> the need for kernel patches. It is a bit heavyweight for a
> general-purpose system though.

So the user mode helper would be launched whenever there is a module 
request and it would check whether the process is allowed to load 
modules or not? Does it know which process caused the module to be 
loaded and what were its credentials at that time?

-Topi