capabilites: allow the application of capability limits to usermode helpers

There is no way to limit the capabilities of usermodehelpers. This problem reared its head recently when someone complained that any user with cap_net_admin was able to load arbitrary kernel modules, even though the user didn't have cap_sys_module. The reason is because the actual load is done by a usermode helper and those always have the full cap set. This patch addes new sysctls which allow us to bound the permissions of usermode helpers.

/proc/sys/kernel/usermodehelper/bset
/proc/sys/kernel/usermodehelper/inheritable

You must have CAP_SYS_MODULE and CAP_SET_PCAP to change these (changes are &= ONLY). When the kernel launches a usermodehelper it will do so with these as the bset and pI.

-v2: make globals static
create spinlock to protect globals

-v3: require both CAP_SET_PCAP and CAP_SYS_MODULE

No-objection-from: Serge E. Hallyn <[email protected]>

---

 include/linux/kmod.h |    3 ++
 kernel/kmod.c        |  100 ++++++++++++++++++++++++++++++++++++++++++++++++++
 kernel/sysctl.c      |    6 +++
 3 files changed, 109 insertions(+), 0 deletions(-)

index 6efd7a7..79bb98d 100644
@@ -24,6 +24,7 @@
 #include <linux/errno.h>
 #include <linux/compiler.h>
 #include <linux/workqueue.h>
+#include <linux/sysctl.h>
 
 #define KMOD_PATH_LEN 256
 

@@ -109,6 +110,8 @@ call_usermodehelper(char *path, char **argv, char **envp, enum umh_wait wait)
 				       NULL, NULL, NULL);
 }
 
+extern struct ctl_table usermodehelper_table[];
+
 extern void usermodehelper_init(void);
 
 extern int usermodehelper_disable(void);

index c0bb324..965134b 100644
@@ -56,6 +56,7 @@
 #include <linux/kprobes.h>
 #include <linux/pipe_fs_i.h>
 #include <linux/oom.h>
+#include <linux/kmod.h>
 
 #include <asm/uaccess.h>
 #include <asm/processor.h>

@@ -616,6 +617,11 @@ static struct ctl_table kern_table[] = {
 		.child		= random_table,
 	},
 	{
+		.procname	= "usermodehelper",
+		.mode		= 0555,
+		.child		= usermodehelper_table,
+	},
+	{
 		.procname	= "overflowuid",
 		.data		= &overflowuid,
 		.maxlen		= sizeof(int),