| |||||||||||||
Capabilities for loading network modulesCapabilities for loading network modulesPosted Mar 3, 2011 5:39 UTC (Thu) by josh (subscriber, #17465)Parent article: Capabilities for loading network modules
Even requiring /lib/modules doesn't quite suffice: this would make CAP_NET_ADMIN sufficient to break into the kernel from a chroot, for instance.
(Log in to post comments)
Capabilities for loading network modules Posted Mar 10, 2011 10:33 UTC (Thu) by segoon (guest, #61133) [Link]
No, usermodehelper forks new process (modprobe for modules loading) from khelper thread. [khelper] is running in root namespace, so it is only root namespace's /lib/modules.
|
|||||||||||||