2016-07-31 09:48:15

by Russell Coker

Subject: [refpolicy] [PATCH] ifconfig loads kernel modules

The following patch allows ifconfig to trigger module loads.


diff -ruN /home/rjc/src/pol-git/policy/modules/system/sysnetwork.te ./policy/modules/system/sysnetwork.te
--- /home/rjc/src/pol-git/policy/modules/system/sysnetwork.te 2016-07-28 20:33:39.971961928 +1000
+++ ./policy/modules/system/sysnetwork.te 2016-07-31 19:47:25.822898970 +1000
@@ -261,6 +261,7 @@
# Ifconfig local policy
#

+kernel_load_module(ifconfig_t)
allow ifconfig_t self:capability { net_raw net_admin sys_admin sys_tty_config };
allow ifconfig_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack };
allow ifconfig_t self:fd use;

2016-08-02 23:38:02

by Chris PeBenito

Subject: [refpolicy] [PATCH] ifconfig loads kernel modules

On 07/31/16 05:48, Russell Coker wrote:
> The following patch allows ifconfig to trigger module loads.
>
>
> diff -ruN /home/rjc/src/pol-git/policy/modules/system/sysnetwork.te ./policy/modules/system/sysnetwork.te
> --- /home/rjc/src/pol-git/policy/modules/system/sysnetwork.te 2016-07-28 20:33:39.971961928 +1000
> +++ ./policy/modules/system/sysnetwork.te 2016-07-31 19:47:25.822898970 +1000
> @@ -261,6 +261,7 @@
> # Ifconfig local policy
> #
>
> +kernel_load_module(ifconfig_t)
> allow ifconfig_t self:capability { net_raw net_admin sys_admin sys_tty_config };
> allow ifconfig_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack };
> allow ifconfig_t self:fd use;

Is this a current denial? If so, what version of net-tools is that on?

ifconfig_t already has kernel_request_load_module(ifconfig_t) so I'm
unclear why it would be directly loading modules itself.

--
Chris PeBenito

2016-08-03 02:28:53

by Russell Coker

Subject: [refpolicy] [PATCH] ifconfig loads kernel modules

On Wed, 3 Aug 2016 09:38:02 AM Chris PeBenito wrote:
> > +kernel_load_module(ifconfig_t)
> >
> > allow ifconfig_t self:capability { net_raw net_admin sys_admin
> >sys_tty_config }; allow ifconfig_t self:process ~{ ptrace setcurrent
> >setexec setfscreate setrlimit execmem execheap execstack }; allow
> >ifconfig_t self:fd use;
>
> Is this a current denial? If so, what version of net-tools is that on?
>
> ifconfig_t already has kernel_request_load_module(ifconfig_t) so I'm
> unclear why it would be directly loading modules itself.

It's been in my tree for years. I'll remove it and see what happens.

--
My Main Blog http://etbe.coker.com.au/
My Documents Blog http://doc.coker.com.au/

2016-08-03 02:37:33

by Jason Zaman

Subject: [refpolicy] [PATCH] ifconfig loads kernel modules

On Wed, Aug 03, 2016 at 12:28:53PM +1000, Russell Coker wrote:
> On Wed, 3 Aug 2016 09:38:02 AM Chris PeBenito wrote:
> > > +kernel_load_module(ifconfig_t)
> > >
> > > allow ifconfig_t self:capability { net_raw net_admin sys_admin
> > >sys_tty_config }; allow ifconfig_t self:process ~{ ptrace setcurrent
> > >setexec setfscreate setrlimit execmem execheap execstack }; allow
> > >ifconfig_t self:fd use;
> >
> > Is this a current denial? If so, what version of net-tools is that on?
> >
> > ifconfig_t already has kernel_request_load_module(ifconfig_t) so I'm
> > unclear why it would be directly loading modules itself.
>
> It's been in my tree for years. I'll remove it and see what happens.

I've seen this on my gentoo machines for a fair while too but not dug
deeper into why. I assumed it was something to do with firmware loading
when the wifi modules come up but could be completely wrong. I think I
only see it during first boot tho not later on.

-- Jason
>
> --
> My Main Blog http://etbe.coker.com.au/
> My Documents Blog http://doc.coker.com.au/
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy