4 ms·

> Does anyone know if it's possible to disable module auto-loading for a tree/namespace of processes, e.g. a Docker container, but keep it working for the base

• justincormack 10y ago
  That is the default in Docker.
  • geofft 10y ago
    This is module auto-loading, i.e., you don't need CAP_SYS_MODULE, nor do you make an init_module syscall. The only syscall you make is socket(...IPPROTO_DCCP), and the kernel asks /sbin/modprobe (which it runs with full privileges) to load the appropriate module. The userspace program does not have any privileges. Does Docker actually block that? amluto's comment about the Timgad LSM implies that such functionality doesn't exist yet. (And the replies on LKML show the same confusion between explicit module loading, which requires privilege, and auto-loading, which does not. https://lkml.org/lkml/2017/2/6/279 https://lkml.org/lkml/2017/2/6/279) The easy way to try this is to lsmod and look for dccp and dccp_ipv4, `modprobe -r` them if they're already there, run python -c 'from socket import *; socket(AF_INET, 6, 33)' in your container, and lsmod again and see if they're present.
    • justincormack 10y ago
      Yeah true. Docker master has a seccomp profile that blocks this socket family though.