grsecurity forums

hello,

there is a nice feature /proc/sys/kernel/grsecurity/disable_modules, which prevents any module inserting/removing at runtime.

but turning it on prevents disabling it even if there is "0" in grsec_lock
can this feature be somehow temporarily disabled(for inserting a newly compiled module without reboot)?

it could be done with keeping 0 in disable_modules and using ACL, prevent execution of modproble/insmod/rmmod commands. but i'm not sure if it is sufficient. are there other ways for module manipulation and can they be prevented, keeping the ability of temporarily allowing them?

What version of grsecurity are you using? This should have been fixed in the latest version.

-Brad

i'm using gentoo linux with kernel 2.6.16-hardened-r10 and gradm v2.1.9

and get this:
echo 0 > disable_modules
-su: echo: write error: Operation not permitted

while
grsec_lock is 0

###EDIT: perhaps disabling CAP_SYS_MODULE for every subject and role would help?