linux-kernel - Re: request_module vs. modprobe blacklist (and security subsystem implications)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1256307830.4443.158.camel@dhcp231-106.rdu.redhat.com>
Date:	Fri, 23 Oct 2009 10:23:50 -0400
From:	Eric Paris <eparis@...hat.com>
To:	Rusty Russell <rusty@...tcorp.com.au>
Cc:	Alan Jenkins <sourcejedi.lkml@...glemail.com>,
	linux-kernel@...r.kernel.org, arjan@...radead.org,
	randy.dunlap@...cle.com, andi@...stfloor.org, dhowells@...hat.com,
	akpm@...ux-foundation.org
Subject: Re: request_module vs. modprobe blacklist (and security subsystem
 implications)

On Fri, 2009-10-23 at 19:46 +1030, Rusty Russell wrote:
> On Fri, 23 Oct 2009 01:00:22 am Eric Paris wrote:
> > > If a userspace program tries some security exploit that has been closed, do
> > > you want to warn about it?  Because that seems to be the question here.
> > 
> > I say yes.  Knowing that malicious activity is taking place, even if it
> > didn't hurt anything is useful.
> 
> Hi Eric,
> 
> Your proposal is troubling for three reasons:
> 
> 1) You would disable logging for things you actually want logged.

I would?

> 2) What *actually* happens when ssh tries to load ipv6 is that
>    "modprobe net-pf-10" gets called.
> 3) Containing modprobe behavior in one set of config files is really nice.

It is it also means that we, somewhat regularly call userspace
needlessly and there is nothing an admin can do to stop it.

But it appears you disagree that fixing that problem is worth it, and I
don't feel strongly enough to keep arguing  :)

-Eric


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/