Date: Sun, 31 Jul 2016 10:39:04 +0000 From: "Reshetova, Elena" <elena.reshetova@...el.com> To: Jann Horn <jann@...jh.net>, "kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com> CC: "linux-security-module@...r.kernel.org" <linux-security-module@...r.kernel.org>, "keescook@...omium.org" <keescook@...omium.org>, "spender@...ecurity.net" <spender@...ecurity.net>, "jmorris@...ei.org" <jmorris@...ei.org>, "Schaufler, Casey" <casey.schaufler@...el.com>, "Leibowitz, Michael" <michael.leibowitz@...el.com>, "Roberts, William C" <william.c.roberts@...el.com> Subject: RE: [RFC] [PATCH 4/5] invoke path_chroot() LSM hook on mntns_install() On Fri, Jul 29, 2016 at 10:34:39AM +0300, Elena Reshetova wrote: > This adds an additional invocation of the security_path_chroot LSM > hook inside mntns_install(). > Currently only capabilities are checked at this point, while process > root actually changes. >Are you aware that unprivileged user namespace creation doesn't work in a chrooted process? See the invocation of current_chrooted() in create_user_ns(). This means that for this new LSM hook to make any sense, a namespace admin has to attempt >to sandbox himself with chroot(). I am not sure I understand you fully here. It is possible to create new mount namespace without creating new user namespace, and when this happens, if I understand the code right, there is no check like current_chrooted() or smth like this. So, how does it relate to user namespace? >If the current namespace is the init namespace, the process has CAP_SYS_ADMIN in the init namespace, meaning that filesystem sandboxing is probably useless. >If the current namespace is not the init namespace, the process probably used namespaces to sandbox itself, in which case it wouldn't be using chroot in the first place, Why? It is possible that we might be running in the namespace some daemon which just uses chroot by default (legacy or whatever). I think you even proposed that in another email. >r it is running in a container with admin privileges. >In the latter case, this mitigation miiight make a difference, I'm not sure exactly how powerful the APIs for namespace admins are - but a mitigation that only makes a difference inside containers would be weird anyway. >So: What is your specific usecase here? The usecase was similar to the unshare cases: we need to find places where current process's root changes in the code and make sure we catch this change in order to have the up-to-date information about each process's root. So, if we have a process that was put into chroot, but then also creates a mount ns inside? If we recorded the dentry of chrooted process , but then not update it upon mount ns creation, we might end up with wrong entry and all kinds of problems around it. But yes, the whole relationship with namespaces is tricky and there are sooo many edge cases. I will try to create a list of possible combinations and use cases. It is true that this hardening LSM has a particular set of use-cases in mind and there is no need to support all possible combinations. I haven't even tested this at all with namespaces yet, which would be separate fun on its own... Download attachment "smime.p7s" of type "application/pkcs7-signature" (7586 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.