[kernel-hardening] [PATCH v4 next 0/3] modules: automatic module loading restrictions
flat view
From: Kees Cook <hidden>
Date: 2017-05-22 23:52:22
Also in:
linux-api, lkml, netdev
On Mon, May 22, 2017 at 4:38 PM, Andy Lutomirski [off-list ref] wrote:
I think that having the un-resettable mode is unnecessary. We should have option that disables loading modules entirely and cannot be unset. (That means no explicit loads and not implicit loads.) Maybe we already have this. Otherwise, tightening caps needed for implicit loads should just be a normal yes/no setting IMO.
Yup, /proc/sys/kernel/modules_disabled already does this. -- Kees Cook Pixel Security -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html