On 10.4.2023 21.37, Greg KH wrote:
On Mon, Apr 10, 2023 at 01:06:00PM +0300, Topi Miettinen wrote:
I'd propose to add a per-process flag to irrevocably deny any loading of
kernel modules for the process and its children. The flag could be set (but
not unset) via prctl() and for unprivileged processes, only when
NoNewPrivileges is also set. This would be similar to CAP_SYS_MODULE, but
unlike capabilities, there would be no issues with namespaces since the flag
isn't namespaced.
The implementation should be very simple.
Patches are always welcome to be reviewed.
But note, please watch out for processes that cause devices to be found,
and then modules to be loaded that way, it's not going to be as simple
as you might have imagined...
A very simple version would only add a simple check like
!current->allow_module_load after every !capable(CAP_SYS_MODULE). It
wouldn't block all the ways how modules could be caused to be loaded
indirectly.
I think a less simple version could also do the check at __request_module().
-Topi
