From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933160AbdEOSOs (ORCPT ); Mon, 15 May 2017 14:14:48 -0400 Received: from shards.monkeyblade.net ([184.105.139.130]:38086 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753912AbdEOSOq (ORCPT ); Mon, 15 May 2017 14:14:46 -0400 Date: Mon, 15 May 2017 14:14:44 -0400 (EDT) Message-Id: <20170515.141444.2109254753464149113.davem@davemloft.net> To: maheshb@google.com Cc: gregkh@linuxfoundation.org, ebiederm@xmission.com, mahesh@bandewar.net, mingo@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, keescook@chromium.org, edumazet@google.com Subject: Re: [PATCH] kmod: don't load module unless req process has CAP_SYS_MODULE From: David Miller In-Reply-To: References: <20170515061059.GB28741@kroah.com> <20170515.095228.1483686375235860235.davem@davemloft.net> X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=utf-8 X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Mon, 15 May 2017 10:33:14 -0700 (PDT) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by mail.home.local id v4FIEpf1019873 From: Mahesh Bandewar (महेश बंडेवार) Date: Mon, 15 May 2017 10:59:55 -0700 > The current behavior is already breaking things. e.g. unprivileged > process can be root inside it's own user-ns. This will allow it to > create IPtable rules causing contracking module to be loaded in > default-ns affecting every flow on the server (not just the namespace > that user or an unprivileged process is attached to). Cases that I > mentioned above are just the tip of an iceberg. Yes, that is certainly undesirable. But is it really a module loading problem? Perhaps we need to look more deeply into how conntract behaves by default wrt. namespaces. If we've given the user the ability to be root in his or her own namespace, then we should let them do root stuff in there. The only problem is when "doing root stuff in there" has an undesirable impact upon the rest of the system. And that's needs to be looked into on a facility by facility basis, rather then just sprinkling "no module loading" test here and there, or even unconditionally.