CONFIG_STATIC_USERMODEHELPER: Force all usermode helper calls through a single binary

General informations

The Linux kernel configuration item CONFIG_STATIC_USERMODEHELPER:

• prompt: Force all usermode helper calls through a single binary
• type: bool
• depends on: (none)
• defined in security/Kconfig
• found in Linux kernels: 4.11–4.20, 5.0–5.19, 6.0–6.8, 6.9-rc+HEAD

Help text

By default, the kernel can call many different userspace binary programs through the "usermode helper" kernel interface. Some of these binaries are statically defined either in the kernel code itself, or as a kernel configuration option. However, some of these are dynamically created at runtime, or can be modified after the kernel has started up. To provide an additional layer of security, route all of these calls through a single executable that can not have its name changed.

Note, it is up to this single binary to then call the relevant "real" usermode helper binary, based on the first argument passed to it. If desired, this program can filter and pick and choose what real programs are called.

If you wish for all usermode helper programs are to be disabled, choose this option and then set STATIC_USERMODEHELPER_PATH to an empty string.

Hardware

LKDDb

Raw data from LKDDb:

• (none)

Sources

This page is automaticly generated with free (libre, open) software lkddb(see lkddb-sources).

The data is retrived from:

• Linux kernel
• Linux Kernel Driver DataBase (LKDDb)

Automatic links from Google (and ads)

Custom Search

Popular queries: