Re: [PATCH v5 next 3/5] modules:capabilities: automatic module loading restriction

2017-11-30 Thread Djalal Harouni
On Thu, Nov 30, 2017 at 2:23 AM, Luis R. Rodriguez wrote: > On Mon, Nov 27, 2017 at 06:18:36PM +0100, Djalal Harouni wrote: >> diff --git a/include/linux/module.h b/include/linux/module.h >> index 5cbb239..c36aed8 100644 >> --- a/include/linux/module.h >> +++

Re: [PATCH v5 next 3/5] modules:capabilities: automatic module loading restriction

2017-11-30 Thread Djalal Harouni
On Thu, Nov 30, 2017 at 2:23 AM, Luis R. Rodriguez wrote: > On Mon, Nov 27, 2017 at 06:18:36PM +0100, Djalal Harouni wrote: >> diff --git a/include/linux/module.h b/include/linux/module.h >> index 5cbb239..c36aed8 100644 >> --- a/include/linux/module.h >> +++ b/include/linux/module.h >> @@ -261,7

Re: [PATCH v5 next 3/5] modules:capabilities: automatic module loading restriction

2017-11-29 Thread Luis R. Rodriguez
On Mon, Nov 27, 2017 at 06:18:36PM +0100, Djalal Harouni wrote: > diff --git a/include/linux/module.h b/include/linux/module.h > index 5cbb239..c36aed8 100644 > --- a/include/linux/module.h > +++ b/include/linux/module.h > @@ -261,7 +261,16 @@ struct notifier_block; > > #ifdef CONFIG_MODULES >

Re: [PATCH v5 next 3/5] modules:capabilities: automatic module loading restriction

2017-11-29 Thread Luis R. Rodriguez
On Mon, Nov 27, 2017 at 06:18:36PM +0100, Djalal Harouni wrote: > diff --git a/include/linux/module.h b/include/linux/module.h > index 5cbb239..c36aed8 100644 > --- a/include/linux/module.h > +++ b/include/linux/module.h > @@ -261,7 +261,16 @@ struct notifier_block; > > #ifdef CONFIG_MODULES >

[PATCH v5 next 3/5] modules:capabilities: automatic module loading restriction

2017-11-27 Thread Djalal Harouni
Currently, an explicit call to load or unload kernel modules require CAP_SYS_MODULE capability. However unprivileged users have always been able to load some modules using the implicit auto-load operation. An automatic module loading happens when programs request a kernel feature from a module

[PATCH v5 next 3/5] modules:capabilities: automatic module loading restriction

2017-11-27 Thread Djalal Harouni
Currently, an explicit call to load or unload kernel modules require CAP_SYS_MODULE capability. However unprivileged users have always been able to load some modules using the implicit auto-load operation. An automatic module loading happens when programs request a kernel feature from a module