Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S940411AbdDSXQs (ORCPT ); Wed, 19 Apr 2017 19:16:48 -0400 Received: from mail.kernel.org ([198.145.29.136]:47120 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S938267AbdDSXQr (ORCPT ); Wed, 19 Apr 2017 19:16:47 -0400 MIME-Version: 1.0 In-Reply-To: <1492640420-27345-2-git-send-email-tixxdz@gmail.com> References: <1492640420-27345-1-git-send-email-tixxdz@gmail.com> <1492640420-27345-2-git-send-email-tixxdz@gmail.com> From: Andy Lutomirski Date: Wed, 19 Apr 2017 16:16:22 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH v3 1/2] modules:capabilities: automatic module loading restriction To: Djalal Harouni Cc: Linux Kernel Mailing List , Andy Lutomirski , Kees Cook , Andrew Morton , "Serge E. Hallyn" , "kernel-hardening@lists.openwall.com" , LSM List , Linux API , Dongsu Park , Casey Schaufler , James Morris , Paul Moore , Tetsuo Handa , Greg Kroah-Hartman , Jonathan Corbet , Jessica Yu , Rusty Russell , Arnaldo Carvalho de Melo , Mauro Carvalho Chehab , Ingo Molnar , zendyani@gmail.com, Peter Zijlstra Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 525 Lines: 11 On Wed, Apr 19, 2017 at 3:20 PM, Djalal Harouni wrote: > Currently, an explicit call to load or unload kernel modules require > CAP_SYS_MODULE capability. However unprivileged users have always been > able to load some modules using the implicit auto-load operation. An > automatic module loading happens when programs request a kernel feature > from a module that is not loaded. In order to satisfy userspace, the > kernel then automatically load all these required modules. I like this feature. --Andy