On Thu, 2017-04-20 at 00:20 +0200, Djalal Harouni wrote:
[...] 

+modules_autoload:
+
+A sysctl to control if modules auto-load feature is allowed or not.
+This sysctl complements "modules_disabled" which is for all module
+operations where this flag applies only to automatic module loading.
+Automatic module loading happens when programs request a kernel feature
+that is implemented by an unloaded module, the kernel automatically
+runs the program pointed by "modprobe" sysctl in order to load the
+corresponding module.
+
+When modules_autoload is set to (0), the default, there are no
+restrictions.
+
+When modules_autoload is set to (1), processes must have CAP_SYS_MODULE
+to be able to trigger a module auto-load operation, or CAP_NET_ADMIN
+for modules with a 'netdev-%s' alias.
+
+When modules_autoload is set to (2), automatic module loading is
+disabled for all. Once set, this value can not be changed.

I would expect a parameter 'modules_autoload' to be a boolean, so this
behaviour would be surprising.

What is the point of mode 2?  Why would someone want to set
modules_disabled=0 and modules_autoload=2?

[...]

[...]

+static int modules_autoload_privileged_access(const char *name)
+{
+	if (capable(CAP_SYS_MODULE))
+		return 0;
+	else if (name && strstr(name, "netdev-") && capable(CAP_NET_ADMIN))

[...]

We want a prefix match, so use strncmp() not strstr().

Ben.

-- 
Ben Hutchings
It is easier to change the specification to fit the program than vice
versa.