linux-kernel - Re: request_module vs. modprobe blacklist (and security subsystem implications)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200910221626.51170.rusty@rustcorp.com.au>
Date:	Thu, 22 Oct 2009 16:26:49 +1030
From:	Rusty Russell <rusty@...tcorp.com.au>
To:	Eric Paris <eparis@...hat.com>
Cc:	Alan Jenkins <sourcejedi.lkml@...glemail.com>,
	linux-kernel@...r.kernel.org, arjan@...radead.org,
	randy.dunlap@...cle.com, andi@...stfloor.org, dhowells@...hat.com,
	akpm@...ux-foundation.org
Subject: Re: request_module vs. modprobe blacklist (and security subsystem implications)

On Thu, 22 Oct 2009 05:57:28 am Eric Paris wrote:
> Ah yes, not your fault though  :)  The problem is that SELinux reports
> these denials and users get scared.  We can (and now do) silence all of
> these SELinux caused denials, but now we have no notification if a
> malicious program tried to cause the auto loading of a module.

Well, yes.  I think you need to be more careful in your filtering.

If a userspace program tries some security exploit that has been closed, do
you want to warn about it?  Because that seems to be the question here.

Why should ssh not load IPv6?  Because noone should?  Fine, but there's a
difference between "I expect it to do this but I won't let it" and "I don't
expect it to do this".

I think the question is bigger than modprobe.conf vs request_module.

Or am I confused?
Rusty.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/