Restrict module auto-loading to CAP_SYS_ADMIN if CONFIG_MODULE_RESTRICT_AUTOLOAD is enabled, cmdline parameter modrestrict=true, or kernel.modrestrict=1 is set with sysctl.
Signed-off-by: Michal Gorlas <[email protected]> --- kernel/module/internal.h | 1 + kernel/module/kmod.c | 5 +++++ kernel/module/main.c | 11 +++++++++++ 3 files changed, 17 insertions(+) diff --git a/kernel/module/internal.h b/kernel/module/internal.h index 061161cc79d9..496d8703f0c6 100644 --- a/kernel/module/internal.h +++ b/kernel/module/internal.h @@ -46,6 +46,7 @@ struct kernel_symbol { extern struct mutex module_mutex; extern struct list_head modules; +extern bool module_autoload_restrict; extern const struct module_attribute *const modinfo_attrs[]; extern const size_t modinfo_attrs_count; diff --git a/kernel/module/kmod.c b/kernel/module/kmod.c index a25dccdf7aa7..58b28c23f571 100644 --- a/kernel/module/kmod.c +++ b/kernel/module/kmod.c @@ -156,6 +156,11 @@ int __request_module(bool wait, const char *fmt, ...) if (ret) return ret; + if (module_autoload_restrict && !capable(CAP_SYS_ADMIN)) { + pr_alert("denied attempt to auto-load module %s\n", module_name); + return -EPERM; + } + ret = down_timeout(&kmod_concurrent_max, MAX_KMOD_ALL_BUSY_TIMEOUT * HZ); if (ret) { pr_warn_ratelimited("request_module: modprobe %s cannot be processed, kmod busy with %d threads for more than %d seconds now", diff --git a/kernel/module/main.c b/kernel/module/main.c index 46dd8d25a605..a293b75ce9b7 100644 --- a/kernel/module/main.c +++ b/kernel/module/main.c @@ -130,6 +130,10 @@ static void mod_update_bounds(struct module *mod) static int modules_disabled; core_param(nomodule, modules_disabled, bint, 0); +/* Restrict auto-loading? */ +bool module_autoload_restrict = IS_ENABLED(CONFIG_MODULE_RESTRICT_AUTOLOAD); +core_param(modrestrict, module_autoload_restrict, bool, 0); + static const struct ctl_table module_sysctl_table[] = { { .procname = "modprobe", @@ -148,6 +152,13 @@ static const struct ctl_table module_sysctl_table[] = { .extra1 = SYSCTL_ONE, .extra2 = SYSCTL_ONE, }, + { + .procname = "modrestrict", + .data = &module_autoload_restrict, + .maxlen = sizeof(bool), + .mode = 0644, + .proc_handler = proc_dobool, + }, }; static int __init init_module_sysctl(void) -- 2.54.0
