linux-kernel - Per-process flag set via prctl() to deny module loading?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <640c4327-0b40-f964-0b5b-c978683ac9ba@gmail.com>
Date:   Mon, 10 Apr 2023 13:06:00 +0300
From:   Topi Miettinen <toiwoton@...il.com>
To:     linux-modules <linux-modules@...r.kernel.org>,
        Kernel Hardening <kernel-hardening@...ts.openwall.com>,
        "linux-hardening@...r.kernel.org" <linux-hardening@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Per-process flag set via prctl() to deny module loading?

I'd propose to add a per-process flag to irrevocably deny any loading of 
kernel modules for the process and its children. The flag could be set 
(but not unset) via prctl() and for unprivileged processes, only when 
NoNewPrivileges is also set. This would be similar to CAP_SYS_MODULE, 
but unlike capabilities, there would be no issues with namespaces since 
the flag isn't namespaced.

The implementation should be very simple.

Preferably the flag, when configured, would be set by systemd, Firejail 
and maybe also container managers. The expectation would be that the 
permission to load modules would be retained only by udev and where SUID 
needs to be allowed (NoNewPrivileges unset).

-Topi