Date: Thu, 28 Jan 2016 11:41:17 -0600 From: ebiederm@...ssion.com (Eric W. Biederman) To: Kees Cook <keescook@...omium.org> Cc: Andrew Morton <akpm@...ux-foundation.org>, Al Viro <viro@...iv.linux.org.uk>, "Serge E. Hallyn" <serge.hallyn@...ntu.com>, Andy Lutomirski <luto@...nel.org>, "Austin S. Hemmelgarn" <ahferroin7@...il.com>, Richard Weinberger <richard@....at>, Robert Święcki <robert@...ecki.net>, Dmitry Vyukov <dvyukov@...gle.com>, David Howells <dhowells@...hat.com>, Kostya Serebryany <kcc@...gle.com>, Alexander Potapenko <glider@...gle.com>, Eric Dumazet <edumazet@...gle.com>, Sasha Levin <sasha.levin@...cle.com>, linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org, kernel-hardening@...ts.openwall.com Subject: Re: [PATCH v2] sysctl: allow CLONE_NEWUSER to be disabled Kees Cook <keescook@...omium.org> writes: > There continue to be unexpected security exposures when users have access > to CLONE_NEWUSER. So how does this sucessfully address that issue? > For admins of systems that do not use user namespaces > and are running distro kernels with CONFIG_USER_NS enabled, there is > no way to disable CLONE_NEWUSER. This provides a way for sysadmins to > disable the feature to reduce their attack surface without needing to > rebuild their kernels. > > This is inspired by a similar restriction in Grsecurity, but adds > a sysctl. > I have already nacked this patch. Thank you for removing the broken capability in sysctl check. But this does not address any of the other issues I have raised. Nacked-by: "Eric W. Biederman" <ebiederm@...ssion.com> Further as far as I can tell this is just about a witch hunt. Isn't that what you call a campaign against something when the complaining party does not understand something persecutes it and does not bother to try and understand? I have already told you what kind of direction would be acceptable. I gave concrete suggests and here you are wasting our time with this patch again. Eric
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.