On Mon, Apr 10, 2023 at 11:47:16PM +0300, Topi Miettinen wrote: > On 10.4.2023 16.36, Tycho Andersen wrote: > > On Mon, Apr 10, 2023 at 01:06:00PM +0300, Topi Miettinen wrote: > > > I'd propose to add a per-process flag to irrevocably deny any loading of > > > kernel modules for the process and its children. The flag could be set (but > > > not unset) via prctl() and for unprivileged processes, only when > > > NoNewPrivileges is also set. This would be similar to CAP_SYS_MODULE, but > > > unlike capabilities, there would be no issues with namespaces since the flag > > > isn't namespaced. > > > > > > The implementation should be very simple. > > > > > > Preferably the flag, when configured, would be set by systemd, Firejail and > > > maybe also container managers. The expectation would be that the permission > > > to load modules would be retained only by udev and where SUID needs to be > > > allowed (NoNewPrivileges unset). > > > > You can do something like this today via STATIC_USERMODEHELPER without > > the need for kernel patches. It is a bit heavyweight for a > > general-purpose system though. > > So the user mode helper would be launched whenever there is a module request > and it would check whether the process is allowed to load modules or not? Yes, exactly. > Does it know which process caused the module to be loaded and what were its > credentials at that time? It doesn't know which process caused the module load, which is kind of unfortunate. It looks like you could stick it in the environment in kernel/kmod.c:call_modprobe() without breaking too many things, though. Tycho
