linux-kernel - Re: module loading with CAP_NET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 25 Feb 2011 18:29:27 +0300
From:	Michael Tokarev <mjt@....msk.ru>
To:	Vasiliy Kulikov <segoon@...nwall.com>
CC:	Ben Hutchings <bhutchings@...arflare.com>, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, Kees Cook <kees.cook@...onical.com>,
	Eugene Teo <eugene@...hat.com>,
	Dan Rosenberg <dan.j.rosenberg@...il.com>,
	"David S. Miller" <davem@...emloft.net>
Subject: Re: module loading with CAP_NET_ADMIN

25.02.2011 15:30, Vasiliy Kulikov wrote:
> On Thu, Feb 24, 2011 at 16:34 +0000, Ben Hutchings wrote:
>> On Thu, 2011-02-24 at 18:12 +0300, Vasiliy Kulikov wrote:
>>> My proposal is changing request_module("%s", name) to something like
>>> request_module("netdev-%s", name) inside of dev_load() and adding
>>> aliases to related drivers.

It is not the kernel patching which we should worry about, kernel
part is trivial.

What is not trivial is to patch all the systems out there who
autoloads network drivers based on /etc/modprobe.d/network-aliases.conf
(some local file), ie, numerous working setups which already
uses this mechanism since stone age.  And patching these is
not trivial at all, unfortunately.

Somewhat weird setups (one can load the modules explicitly, and
nowadays this all is handled by udev anyway), but this change
will break some working systems.

Maybe the cost (some pain for some users) isn't large enough
but the outcome is good, and I think it _is_ good, but it needs
some wider discussion first, imho.

I can't think of a way to handle this without breaking stuff.

Thanks!

/mjt
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/