Re: request_module vs. modprobe blacklist (and security subsystemimplications)

[Eric Paris]

On Fri, 2009-10-23 at 19:46 +1030, Rusty Russell wrote:
> On Fri, 23 Oct 2009 01:00:22 am Eric Paris wrote:
> > > If a userspace program tries some security exploit that has been closed, do
> > > you want to warn about it?  Because that seems to be the question here.
> > 
> > I say yes.  Knowing that malicious activity is taking place, even if it
> > didn't hurt anything is useful.
> 
> Hi Eric,
> 
> Your proposal is troubling for three reasons:
> 
> 1) You would disable logging for things you actually want logged.

I would?

> 2) What *actually* happens when ssh tries to load ipv6 is that
>    "modprobe net-pf-10" gets called.
> 3) Containing modprobe behavior in one set of config files is really nice.

It is it also means that we, somewhat regularly call userspace
needlessly and there is nothing an admin can do to stop it.

But it appears you disagree that fixing that problem is worth it, and I
don't feel strongly enough to keep arguing  :)

-Eric


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/