[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201103061614.58209.sgrubb@redhat.com>
Date: Sun, 6 Mar 2011 16:14:58 -0500
From: Steve Grubb <sgrubb@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Vasiliy Kulikov <segoon@...nwall.com>
Subject: Re: kernel: modules_disabled policy
On Saturday, March 05, 2011 11:16:43 am Vasiliy Kulikov wrote:
> Is it possible to implement strict do-not-touch-the-kernel policy for
> root via disabling LKM loading and _all_ other indirect places with write
> access that allows root to do something, but being too relaxed and
> allows to write to [almost] arbitrary kernel location? This would make
> root the Boss Of Userland, but as to the kernel it would be but just a
> privileged client. Or such policy would be incomplete and there is
> almost always a way to by-pass it due to the system design?
There's been some discussion on this here:
http://marc.info/?l=linux-security-module&m=129613936129293&w=2
As root, you could modify /etc/modprobe.d/ and add your root kit and issue a system
reboot. That might get attention, but its possible to load modules by rebooting. Along
the same lines, you could regenerate the initramfs with your module being loaded
there.
What was proposed was another kind of deployment module where the initramfs and kernel
is on readonly media so any kernel updates have no effect. The initramfs has all the
kernel modules that wil ever be loaded and anything that manages to live in
/lib/modules will not be used for anything. Since root is in control of user space, he
could change any program that the kernel calls out to load modules. So in the
initramfs we want to drop 2 capabilities so that all kernel helpers are not able to
run with CAP_SYS_MODULE or CAP_SYS_RAWIO.
There are lots of loose ends. I think you found another place where root in the
traditional sense was perfectly fine doing a snapshot. But if you want to allow anyone
to have root, but not be able to get arbitrary code running at ring0, there will be
quite a bit of looking for these uncontrolled places and getting them under some
capability check that can be excluded without diminishing roots abilities too much.
-Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
