public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* user ns: arbitrary module loading
@ 2013-03-02  1:22 Kees Cook
  2013-03-03  0:57 ` Serge E. Hallyn
  0 siblings, 1 reply; 25+ messages in thread
From: Kees Cook @ 2013-03-02  1:22 UTC (permalink / raw)
  To: Eric W. Biederman; +Cc: LKML, Serge Hallyn, Brad Spengler, Al Viro

The rearranging done for user ns has resulted in allowing arbitrary
kernel module loading[1] (i.e. re-introducing a form of CVE-2011-1019)
by what is assumed to be an unprivileged process.

At present, it does look to require at least CAP_SETUID along the way
to set up the uidmap (but things like the setuid helper newuidmap
might soon start providing such a thing by default).

It might be worth examining GRKERNSEC_MODHARDEN in grsecurity, which
examines module symbols to verify that request_module() for a
filesystem only loads a module that defines "register_filesystem"
(among other things).

-Kees

[1] https://twitter.com/grsecurity/status/307473816672665600

--
Kees Cook
Chrome OS Security

^ permalink raw reply	[flat|nested] 25+ messages in thread

end of thread, other threads:[~2013-03-05 23:24 UTC | newest]

Thread overview: 25+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-03-02  1:22 user ns: arbitrary module loading Kees Cook
2013-03-03  0:57 ` Serge E. Hallyn
2013-03-03  1:18   ` Kees Cook
2013-03-03  3:56     ` Serge E. Hallyn
2013-03-03 10:14       ` [RFC][PATCH] fs: Limit sys_mount to only loading filesystem modules Eric W. Biederman
2013-03-03 15:29         ` Serge E. Hallyn
2013-03-03 18:30         ` Kees Cook
2013-03-03 17:48       ` user ns: arbitrary module loading Kees Cook
2013-03-04  8:29         ` Mathias Krause
2013-03-04 16:46           ` Kees Cook
2013-03-04 18:21             ` Eric W. Biederman
2013-03-04 18:41               ` Kees Cook
2013-03-03  4:12   ` Eric W. Biederman
2013-03-03 18:18     ` Kees Cook
2013-03-03 21:58       ` Eric W. Biederman
2013-03-04  2:35         ` Kees Cook
2013-03-04  3:54           ` Eric W. Biederman
2013-03-04  7:48           ` [PATCH 0/2] userns bug fixes for v3.9-rc2 for review Eric W. Biederman
2013-03-04  7:50             ` [PATCH 1/2] userns: Stop oopsing in key_change_session_keyring Eric W. Biederman
2013-03-04  7:51             ` [PATCH 2/2] fs: Limit sys_mount to only request filesystem modules Eric W. Biederman
2013-03-04 17:36               ` Vasily Kulikov
2013-03-04 18:36                 ` Eric W. Biederman
2013-03-05 19:06               ` Kay Sievers
2013-03-05 19:32                 ` Kees Cook
2013-03-05 23:24                 ` Eric W. Biederman

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox