From: Greg KH <gregkh@linuxfoundation.org>
To: Topi Miettinen <toiwoton@gmail.com>
Cc: linux-modules <linux-modules@vger.kernel.org>,
Kernel Hardening <kernel-hardening@lists.openwall.com>,
"linux-hardening@vger.kernel.org"
<linux-hardening@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: Per-process flag set via prctl() to deny module loading?
Date: Mon, 10 Apr 2023 20:37:06 +0200 [thread overview]
Message-ID: <2023041010-vacation-scribble-ba46@gregkh> (raw)
In-Reply-To: <640c4327-0b40-f964-0b5b-c978683ac9ba@gmail.com>
On Mon, Apr 10, 2023 at 01:06:00PM +0300, Topi Miettinen wrote:
> I'd propose to add a per-process flag to irrevocably deny any loading of
> kernel modules for the process and its children. The flag could be set (but
> not unset) via prctl() and for unprivileged processes, only when
> NoNewPrivileges is also set. This would be similar to CAP_SYS_MODULE, but
> unlike capabilities, there would be no issues with namespaces since the flag
> isn't namespaced.
>
> The implementation should be very simple.
Patches are always welcome to be reviewed.
But note, please watch out for processes that cause devices to be found,
and then modules to be loaded that way, it's not going to be as simple
as you might have imagined...
thanks,
greg k-h
next prev parent reply other threads:[~2023-04-10 18:37 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-10 10:06 Per-process flag set via prctl() to deny module loading? Topi Miettinen
2023-04-10 13:36 ` Tycho Andersen
2023-04-10 20:47 ` Topi Miettinen
2023-04-10 21:25 ` Tycho Andersen
2023-04-10 18:37 ` Greg KH [this message]
2023-04-10 21:04 ` Topi Miettinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2023041010-vacation-scribble-ba46@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-modules@vger.kernel.org \
--cc=toiwoton@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox