github.com/rigado/snapd@v2.42.5-go-mod+incompatible/interfaces/builtin/kernel_module_control.go (about) 1 // -*- Mode: Go; indent-tabs-mode: t -*- 2 3 /* 4 * Copyright (C) 2016-2017 Canonical Ltd 5 * 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 3 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 */ 19 20 package builtin 21 22 const kernelModuleControlSummary = `allows insertion, removal and querying of kernel modules` 23 24 const kernelModuleControlBaseDeclarationPlugs = ` 25 kernel-module-control: 26 allow-installation: false 27 deny-auto-connection: true 28 ` 29 30 const kernelModuleControlBaseDeclarationSlots = ` 31 kernel-module-control: 32 allow-installation: 33 slot-snap-type: 34 - core 35 deny-auto-connection: true 36 ` 37 38 const kernelModuleControlConnectedPlugAppArmor = ` 39 # Description: Allow insertion, removal and querying of modules. 40 41 capability sys_module, 42 @{PROC}/modules r, 43 /{,usr/}bin/kmod ixr, 44 45 # FIXME: moved to physical-memory-observe (remove this in series 20) 46 /dev/mem r, 47 48 # Required to use SYSLOG_ACTION_READ_ALL and SYSLOG_ACTION_SIZE_BUFFER when 49 # /proc/sys/kernel/dmesg_restrict is '1' (syslog(2)). These operations are 50 # required to verify kernel modules that are loaded. This also exposes kernel 51 # pointer addresses via %pK format specifiers for processes running with this 52 # capability when accessing /proc/kallsyms, etc when kptr_restrict=1. 53 capability syslog, 54 55 # Allow reading information about loaded kernel modules 56 /sys/module/{,**} r, 57 /etc/modprobe.d/{,**} r, 58 /lib/modprobe.d/{,**} r, 59 ` 60 61 const kernelModuleControlConnectedPlugSecComp = ` 62 # Description: Allow insertion, removal and querying of modules. 63 64 init_module 65 finit_module 66 delete_module 67 ` 68 69 var kernelModuleControlConnectedPlugUDev = []string{`KERNEL=="mem"`} 70 71 func init() { 72 registerIface(&commonInterface{ 73 name: "kernel-module-control", 74 summary: kernelModuleControlSummary, 75 implicitOnCore: true, 76 implicitOnClassic: true, 77 baseDeclarationPlugs: kernelModuleControlBaseDeclarationPlugs, 78 baseDeclarationSlots: kernelModuleControlBaseDeclarationSlots, 79 connectedPlugAppArmor: kernelModuleControlConnectedPlugAppArmor, 80 connectedPlugSecComp: kernelModuleControlConnectedPlugSecComp, 81 connectedPlugUDev: kernelModuleControlConnectedPlugUDev, 82 reservedForOS: true, 83 }) 84 }