lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 24 Apr 2017 13:59:48 +0930
From:   Rusty Russell <>
To:     Djalal Harouni <>,
        Linux Kernel Mailing List <>,
        Andy Lutomirski <>,
        Kees Cook <>,
        Andrew Morton <>,,,
Cc:     Linux API <>,
        Dongsu Park <>,
        Casey Schaufler <>,
        James Morris <>,
        Paul Moore <>,
        Tetsuo Handa <>,
        Greg Kroah-Hartman <>,
        Jonathan Corbet <>, Jessica Yu <>,
        Arnaldo Carvalho de Melo <>,
        Mauro Carvalho Chehab <>,
        Ingo Molnar <>,,
        Peter Zijlstra <>,
        Djalal Harouni <>
Subject: Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction

Djalal Harouni <> writes:
> When value is (1), task must have CAP_SYS_MODULE to be able to trigger a
> module auto-load operation, or CAP_NET_ADMIN for modules with a
> 'netdev-%s' alias.

Sorry, the magic 'netdev-' prefix is a crawling horror.  To do this
properly, you need to hand the capability (if any) from the
request_module() call.  Probably by adding a new request_module_cap and
making request_module() call that, then fixing up the callers.


Powered by blists - more mailing lists