DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=sender:date:from:to:cc:subject:message-id:references:mime-version
         :content-type:content-disposition:in-reply-to:user-agent;
        b=Q6UsfF+xTrsctnfUQEaYhs3pkRoigzewtyT24mkrmxcXABPPkQLMSkOBhu+uQZpIZm
         C+Fdf1iDkdPUHt7zKK2iciVp/OeEwlhP1jfXvwG55PJ80FCb1zmu7AlwcKS1gn35rOJM
         UZEyjdS+O6IpLtBPqD5AlBtwlGUYoTAjJ/kmw=
Date: Thu, 10 Mar 2011 01:06:34 +0300
From: Vasiliy Kulikov <segoon@openwall.com>
To: Michael Tokarev <mjt@tls.msk.ru>
Cc: linux-kernel@vger.kernel.org, arnd@arndb.de, mirqus@gmail.com,
        netdev@vger.kernel.org, Ben Hutchings <bhutchings@solarflare.com>,
        David Miller <davem@davemloft.net>, kuznet@ms2.inr.ac.ru,
        pekkas@netcore.fi, jmorris@namei.org, yoshfuji@linux-ipv6.org,
        kaber@trash.net, eric.dumazet@gmail.com, therbert@google.com,
        xiaosuo@gmail.com, jesse@nicira.com, kees.cook@canonical.com,
        eugene@redhat.com, dan.j.rosenberg@gmail.com
Subject: Re: [PATCH v2] net: don't allow CAP_NET_ADMIN to load non-netdev
 kernel modules
Message-ID: <20110309220633.GA14750@albatros>
References: <1299010390.2529.30.camel@bwh-desktop>
 <20110301213313.GA6507@albatros>
 <4D6DEE7C.6020700@msgid.tls.msk.ru>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <4D6DEE7C.6020700@msgid.tls.msk.ru>
User-Agent: Mutt/1.5.20 (2009-06-14)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1249
Lines: 32

On Wed, Mar 02, 2011 at 10:15 +0300, Michael Tokarev wrote:
> 02.03.2011 00:33, Vasiliy Kulikov wrote:
> > Since a8f80e8ff94ecba629542d9b4b5f5a8ee3eb565c any process with
> > CAP_NET_ADMIN may load any module from /lib/modules/.  This doesn't mean
> > that CAP_NET_ADMIN is a superset of CAP_SYS_MODULE as modules are
> > limited to /lib/modules/**.  However, CAP_NET_ADMIN capability shouldn't
> > allow anybody load any module not related to networking.
> > 
> > This patch restricts an ability of autoloading modules to netdev modules
> > with explicit aliases.  This fixes CVE-2011-1019.
> []
> > Reference: https://lkml.org/lkml/2011/2/24/203
> > 
> > Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
> 
> This looks much saner :)
> 
> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

Is there any reason why it is not yet merged?  I've answered to Jake
Edge that it is not a regression.

Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/