Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 22 Jan 2016 14:50:48 -0800
From: Kees Cook <keescook@...omium.org>
To: Robert Święcki <robert@...ecki.net>
Cc: Andrew Morton <akpm@...ux-foundation.org>, Al Viro <viro@...iv.linux.org.uk>, 
	Richard Weinberger <richard@....at>, "Eric W. Biederman" <ebiederm@...ssion.com>, 
	Andy Lutomirski <luto@...capital.net>, Dmitry Vyukov <dvyukov@...gle.com>, 
	David Howells <dhowells@...hat.com>, Kostya Serebryany <kcc@...gle.com>, 
	Alexander Potapenko <glider@...gle.com>, Eric Dumazet <edumazet@...gle.com>, 
	Sasha Levin <sasha.levin@...cle.com>, 
	"linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>, 
	"kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>
Subject: Re: [PATCH 2/2] sysctl: allow CLONE_NEWUSER to be disabled

On Fri, Jan 22, 2016 at 2:47 PM, Robert Święcki <robert@...ecki.net> wrote:
> Seems that Debian and some older Ubuntu versions are already using
>
> $ sysctl -a | grep usern
> kernel.unprivileged_userns_clone = 0
>
> Shall we be consistent wit it?

Oh! I didn't see that on systems I checked. On which version did you find that?

I'd kind of like to keep the _restrict name, as that follows kptr_ and dmesg_...

-Kees

>
> 2016-01-22 23:39 GMT+01:00 Kees Cook <keescook@...omium.org>:
>> There continues to be many CONFIG_USER_NS related security exposures.
>> For admins running distro kernels with CONFIG_USER_NS, there is no way
>> to disable CLONE_NEWUSER. As many systems do not need CLONE_NEWUSER,
>> this provides a way for sysadmins to disable the feature.
>>
>> This is inspired by a similar restriction in Grsecurity, but adds
>> a sysctl.
>>
>> Signed-off-by: Kees Cook <keescook@...omium.org>
>> ---
>>  Documentation/sysctl/kernel.txt | 17 +++++++++++++++++
>>  kernel/sysctl.c                 | 14 ++++++++++++++
>>  kernel/user_namespace.c         |  7 +++++++
>>  3 files changed, 38 insertions(+)
>>
>> diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
>> index bbfc5e339a3d..e9e8a4f949f5 100644
>> --- a/Documentation/sysctl/kernel.txt
>> +++ b/Documentation/sysctl/kernel.txt
>> @@ -85,6 +85,7 @@ show up in /proc/sys/kernel:
>>  - tainted
>>  - threads-max
>>  - unknown_nmi_panic
>> +- userns_restrict
>>  - watchdog
>>  - watchdog_thresh
>>  - version
>> @@ -933,6 +934,22 @@ example.  If a system hangs up, try pressing the NMI switch.
>>
>>  ==============================================================
>>
>> +userns_restrict:
>> +
>> +This toggle indicates whether CLONE_NEWUSER is available. As CLONE_NEWUSER
>> +has many unexpected side-effects and security exposures, this allows the
>> +sysadmin to disable the feature without needing to rebuild the kernel.
>> +
>> +When userns_restrict is set to (0), the default, there are no restrictions.
>> +
>> +When userns_restrict is set to (1), CLONE_NEWUSER is only available to
>> +processes that have CAP_SYS_ADMIN, CAP_SETUID, and CAP_SETGID.
>> +
>> +When userns_restrict is set to (2), CLONE_NEWUSER is not available at all,
>> +and the value is locked to "2" for the duration of the boot.
>> +
>> +==============================================================
>> +
>>  watchdog:
>>
>>  This parameter can be used to disable or enable the soft lockup detector
>> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
>> index fc8899dd636d..ceb8b107fe28 100644
>> --- a/kernel/sysctl.c
>> +++ b/kernel/sysctl.c
>> @@ -112,6 +112,9 @@ extern int sysctl_nr_open_min, sysctl_nr_open_max;
>>  #ifndef CONFIG_MMU
>>  extern int sysctl_nr_trim_pages;
>>  #endif
>> +#ifdef CONFIG_USER_NS
>> +extern int sysctl_userns_restrict;
>> +#endif
>>
>>  /* Constants used for minimum and  maximum */
>>  #ifdef CONFIG_LOCKUP_DETECTOR
>> @@ -812,6 +815,17 @@ static struct ctl_table kern_table[] = {
>>                 .extra2         = &two,
>>         },
>>  #endif
>> +#ifdef CONFIG_USER_NS
>> +       {
>> +               .procname       = "userns_restrict",
>> +               .data           = &sysctl_userns_restrict,
>> +               .maxlen         = sizeof(int),
>> +               .mode           = 0644,
>> +               .proc_handler   = proc_dointvec_minmax_cap_sysadmin,
>> +               .extra1         = &zero,
>> +               .extra2         = &two,
>> +       },
>> +#endif
>>         {
>>                 .procname       = "ngroups_max",
>>                 .data           = &ngroups_max,
>> diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
>> index 9bafc211930c..38395f9625ff 100644
>> --- a/kernel/user_namespace.c
>> +++ b/kernel/user_namespace.c
>> @@ -25,6 +25,7 @@
>>
>>  static struct kmem_cache *user_ns_cachep __read_mostly;
>>  static DEFINE_MUTEX(userns_state_mutex);
>> +int sysctl_userns_restrict __read_mostly;
>>
>>  static bool new_idmap_permitted(const struct file *file,
>>                                 struct user_namespace *ns, int cap_setid,
>> @@ -84,6 +85,12 @@ int create_user_ns(struct cred *new)
>>             !kgid_has_mapping(parent_ns, group))
>>                 return -EPERM;
>>
>> +       if (sysctl_userns_restrict == 2 ||
>> +           (sysctl_userns_restrict == 1 && (!capable(CAP_SYS_ADMIN) ||
>> +                                            !capable(CAP_SETUID) ||
>> +                                            !capable(CAP_SETGID))))
>> +               return -EPERM;
>> +
>>         ns = kmem_cache_zalloc(user_ns_cachep, GFP_KERNEL);
>>         if (!ns)
>>                 return -ENOMEM;
>> --
>> 2.6.3
>>
>
>
>
> --
> Robert Święcki



-- 
Kees Cook
Chrome OS & Brillo Security

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.