You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Vasiliy Kulikov 8909c9ad8f net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules ... Since a8f80e8ff9 any process with CAP_NET_ADMIN may load any module from /lib/modules/. This doesn't mean that CAP_NET_ADMIN is a superset of CAP_SYS_MODULE as modules are limited to /lib/modules/**. However, CAP_NET_ADMIN capability shouldn't allow anybody load any module not related to networking. This patch restricts an ability of autoloading modules to netdev modules with explicit aliases. This fixes CVE-2011-1019. Arnd Bergmann suggested to leave untouched the old pre-v2.6.32 behavior of loading netdev modules by name (without any prefix) for processes with CAP_SYS_MODULE to maintain the compatibility with network scripts that use autoloading netdev modules by aliases like "eth0", "wlan0". Currently there are only three users of the feature in the upstream kernel: ipip, ip_gre and sit. root@albatros:~# capsh --drop=$(seq -s, 0 11),$(seq -s, 13 34) -- root@albatros:~# grep Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: fffffff800001000 CapEff: fffffff800001000 CapBnd: fffffff800001000 root@albatros:~# modprobe xfs FATAL: Error inserting xfs (/lib/modules/2.6.38-rc6-00001-g2bf4ca3/kernel/fs/xfs/xfs.ko): Operation not permitted root@albatros:~# lsmod | grep xfs root@albatros:~# ifconfig xfs xfs: error fetching interface information: Device not found root@albatros:~# lsmod | grep xfs root@albatros:~# lsmod | grep sit root@albatros:~# ifconfig sit sit: error fetching interface information: Device not found root@albatros:~# lsmod | grep sit root@albatros:~# ifconfig sit0 sit0 Link encap:IPv6-in-IPv4 NOARP MTU:1480 Metric:1 root@albatros:~# lsmod | grep sit sit 10457 0 tunnel4 2957 1 sit For CAP_SYS_MODULE module loading is still relaxed: root@albatros:~# grep Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: ffffffffffffffff CapEff: ffffffffffffffff CapBnd: ffffffffffffffff root@albatros:~# ifconfig xfs xfs: error fetching interface information: Device not found root@albatros:~# lsmod | grep xfs xfs 745319 0 Reference: https://lkml.org/lkml/2011/2/24/203 Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Acked-by: David S. Miller <davem@davemloft.net> Acked-by: Kees Cook <kees.cook@canonical.com> Signed-off-by: James Morris <jmorris@namei.org>		14 years ago
..
9p	net/9p: Use proper data types	14 years ago
802	…
8021q	…
appletalk	…
atm	Merge branch 'for-2.6.38' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq	14 years ago
ax25	net: ax25: fix information leak to userland harder	14 years ago
batman-adv	batman-adv: Linearize fragment packets before merge	14 years ago
bluetooth	Bluetooth: Release BTM while sleeping to avoid deadlock	14 years ago
bridge	bridge: Use IPv6 link-local address for multicast listener queries	14 years ago
caif	net/caif: Fix dangling list pointer in freed object on error.	14 years ago
can	can: test size of struct sockaddr in sendmsg	14 years ago
ceph	libceph: fix msgr standby handling	14 years ago
core	net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules	14 years ago
dcb	net: dcbnl: check correct ops in dcbnl_ieee_set()	14 years ago
dccp	dccp: fix oops on Reset after close	14 years ago
decnet	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	14 years ago
dns_resolver	DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076]	14 years ago
dsa	module: fix missing semicolons in MODULE macro usage	14 years ago
econet	econet: remove compiler warnings	14 years ago
ethernet	eth: fix new kernel-doc warning	14 years ago
ieee802154	…
ipv4	net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules	14 years ago
ipv6	net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules	14 years ago
ipx	…
irda	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	14 years ago
iucv	[S390] irq: have detailed statistics for interrupt types	14 years ago
key	…
l2tp	…
lapb	…
llc	…
mac80211	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6	14 years ago
netfilter	netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values	14 years ago
netlabel	net: kill unused macros	14 years ago
netlink	netlink: handle errors from netlink_dump()	14 years ago
netrom	…
packet	net: Use skb_checksum_start_offset()	14 years ago
phonet	phonet: some signedness bugs	14 years ago
rds	…
rfkill	kconfig: rename CONFIG_EMBEDDED to CONFIG_EXPERT	14 years ago
rose	…
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6	14 years ago
sched	net: Fix more stale on-stack list_head objects.	14 years ago
sctp	sctp: fix reporting of unknown parameters	14 years ago
sunrpc	NFS do not find client in NFSv4 pg_authenticate	14 years ago
tipc	tipc: update log.h re-include protection to reflect new name	14 years ago
unix	af_unix: Avoid socket->sk NULL OOPS in stream connect security hooks.	14 years ago
wanrouter	…
wimax	…
wireless	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6	14 years ago
x25	x25: Do not reference freed memory.	14 years ago
xfrm	xfrm: avoid possible oopse in xfrm_alloc_dst	14 years ago
Kconfig	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	14 years ago
Makefile	net: Add batman-adv meshing protocol	14 years ago
TUNABLE	…
compat.c	…
nonet.c	…
socket.c	pass default dentry_operations to mount_pseudo()	14 years ago
sysctl_net.c	…