Bug 645220 - [RFE] kernel: modules: sysctl to block module loading [rhel-4.9]
Summary: [RFE] kernel: modules: sysctl to block module loading [rhel-4.9]
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: kernel
Version: 4.9
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Jerome Marchand
QA Contact: Evan McNabb
URL:
Whiteboard:
Depends On:
Blocks: 645221
TreeView+ depends on / blocked
 
Reported: 2010-10-21 03:11 UTC by Eugene Teo (Security Response)
Modified: 2018-11-14 10:23 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
Clone Of:
: 645221 (view as bug list)
Environment:
Last Closed: 2011-02-16 15:52:34 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:0263 0 normal SHIPPED_LIVE Important: Red Hat Enterprise Linux 4.9 kernel security and bug fix update 2011-02-16 15:14:55 UTC

Description Eugene Teo (Security Response) 2010-10-21 03:11:03 UTC
Description of problem:
Backport of commit 3d43321b7015387cfebbe26436d0e9d299162ea1.

Implement a sysctl file that disables module-loading system-wide.
    
Value can only be set to "1", and is tested only if standard capability checks allow CAP_SYS_MODULE.  Given existing /dev/mem protections, this should allow administrators a one-way method to block module loading after initial boot-time module loading has finished.

Comment 1 Eugene Teo (Security Response) 2010-10-21 03:13:30 UTC
While it is possible to do this with /proc/sys/kernel/cap-bound by removing the CAP_SYS_MODULE capability, the likelihood of writing a wrong value to the proc file is high. Having a modules_disabled sysctl tunable would make it easier for users to disable module loading system-wide.

Comment 4 Vivek Goyal 2010-12-21 15:15:10 UTC
Committed in 94.EL . RPMS are available at http://people.redhat.com/vgoyal/rhel4/

Comment 7 errata-xmlrpc 2011-02-16 15:52:34 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0263.html


Note You need to log in before you can comment on or make changes to this bug.