lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20170515195958.GA16290@breakpoint.cc> Date: Mon, 15 May 2017 21:59:58 +0200 From: Florian Westphal <fw@...len.de> To: "Eric W. Biederman" <ebiederm@...ssion.com> Cc: Mahesh Bandewar (महेश बंडेवार) <maheshb@...gle.com>, David Miller <davem@...emloft.net>, gregkh@...uxfoundation.org, mahesh@...dewar.net, mingo@...nel.org, linux-kernel@...r.kernel.org, linux-netdev <netdev@...r.kernel.org>, keescook@...omium.org, Eric Dumazet <edumazet@...gle.com> Subject: Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE Eric W. Biederman <ebiederm@...ssion.com> wrote: > If loading the conntrack module changes the semantics of packet > processing when nothing is configured that is a bug in the conntrack > module. Thats the default behaviour since forever. modprobe nf_conntrack_ipv4 -- module_init registers netfilter hooks and starts doing connection tracking. You might say 'its wrong' but thats how its been for over a decade. If you have a suggestion on how to transition to a 'sane' behaviour, then I'm all ears. Note however, that conntrack doesn't need any configuration currently. Its just there once module is loaded. We could try hooking into nftables/iptables modules that use conntrack info to make a decision, and thats what we do now in namespaces other than init_net. We still do it be default in iniet_net because someone could be doing conntrack just for purpose of ctnetlink events (conntrack -E and friends, or flow accouting and the like).
Powered by blists - more mailing lists