On Tue, Nov 28, 2017 at 12:20 PM, Kees Cook <keesc...@chromium.org> wrote: > > So what's the right path forward for allowing a way to block > autoloading? Separate existing request_module() calls into "must be > privileged" and "can be unpriv" first, then rework the series to deal > with the "unpriv okay" subset?
So once we've taken care of the networking ones that check their own different capability bit, maybe we can then make the regular request_module() do a rate-limited warning for non-CAP_SYS_MODULE uses that prints which module it's loading. And then just see what people report. Because maybe it's just a very small handful that matters, and we can say "those are ok". And maybe that is too optimistic, and we have a lot of device driver ones because people still have a static /dev and don't have udev populating modules and device nodes, and then maybe we need to introduce a "request_module_dev()" where the rule is that you had to at least have privileges to open the device node. Because I really am *not* interested in these security flags that are off by default and then get turned on by special cases. I think it's completely unacceptable to say "we're insecure by default but then you can do X and be secure". It doesn't work. It doesn't fix anything. Linus