diff options
| author | Stephen Rothwell <sfr@canb.auug.org.au> | 2009-04-23 14:15:38 +1000 |
|---|---|---|
| committer | Stephen Rothwell <sfr@canb.auug.org.au> | 2009-04-23 14:15:38 +1000 |
| commit | 74fded40ae493d76179b17a1c25f2b14f3ec9636 (patch) | |
| tree | 2b25e2570404c6269b16f01b514c6152121e4bb9 /kernel | |
| parent | cd8601d9c7b5fc247babaff0c6b7cb9a178fafba (diff) | |
| parent | 19e4529ee7345079eeacc8e40cf69a304a64dc23 (diff) | |
Merge commit 'security-testing/next'
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/module.c | 7 | ||||
| -rw-r--r-- | kernel/sysctl.c | 12 |
2 files changed, 17 insertions, 2 deletions
diff --git a/kernel/module.c b/kernel/module.c index 2383e60fcf3f..278e9b6762bb 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -73,6 +73,9 @@ DEFINE_MUTEX(module_mutex); EXPORT_SYMBOL_GPL(module_mutex); static LIST_HEAD(modules); +/* Block module loading/unloading? */ +int modules_disabled = 0; + /* Waiting for a module to finish initializing? */ static DECLARE_WAIT_QUEUE_HEAD(module_wq); @@ -778,7 +781,7 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user, char name[MODULE_NAME_LEN]; int ret, forced = 0; - if (!capable(CAP_SYS_MODULE)) + if (!capable(CAP_SYS_MODULE) || modules_disabled) return -EPERM; if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0) @@ -2338,7 +2341,7 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, int ret = 0; /* Must have permission */ - if (!capable(CAP_SYS_MODULE)) + if (!capable(CAP_SYS_MODULE) || modules_disabled) return -EPERM; /* Only one module load at a time, please */ diff --git a/kernel/sysctl.c b/kernel/sysctl.c index e3d2c7dd59b9..e396aa815fec 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -112,6 +112,7 @@ static int ngroups_max = NGROUPS_MAX; #ifdef CONFIG_MODULES extern char modprobe_path[]; +extern int modules_disabled; #endif #ifdef CONFIG_CHR_DEV_SG extern int sg_big_buff; @@ -532,6 +533,17 @@ static struct ctl_table kern_table[] = { .proc_handler = &proc_dostring, .strategy = &sysctl_string, }, + { + .ctl_name = CTL_UNNUMBERED, + .procname = "modules_disabled", + .data = &modules_disabled, + .maxlen = sizeof(int), + .mode = 0644, + /* only handle a transition from default "0" to "1" */ + .proc_handler = &proc_dointvec_minmax, + .extra1 = &one, + .extra2 = &one, + }, #endif #if defined(CONFIG_HOTPLUG) && defined(CONFIG_NET) { |