Re: [kernel-hardening] [PATCH v4 next 0/3] modules: automatic module loading restrictions
From: Kees Cook <hidden>
Date: 2017-05-22 23:52:22
Also in:
linux-api, linux-security-module, lkml
On Mon, May 22, 2017 at 4:38 PM, Andy Lutomirski [off-list ref] wrote:
I think that having the un-resettable mode is unnecessary. We should have option that disables loading modules entirely and cannot be unset. (That means no explicit loads and not implicit loads.) Maybe we already have this. Otherwise, tightening caps needed for implicit loads should just be a normal yes/no setting IMO.
Yup, /proc/sys/kernel/modules_disabled already does this. -- Kees Cook Pixel Security