linux-kernel - [GIT] security: Minor improvements to no_new

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:	Sun, 8 Jul 2012 00:39:23 +1000 (EST)
From:	James Morris <jmorris@...ei.org>
To:	Andy Lutomirski <luto@...capital.net>,
	Linus Torvalds <torvalds@...ux-foundation.org>
cc:	linux-doc@...r.kernel.org, Rob Landley <rob@...dley.net>,
	Kees Cook <keescook@...omium.org>,
	Will Drewry <wad@...omium.org>, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org
Subject: [GIT] security: Minor improvements to no_new_privs documentation

Please pull for 3.5.


The following changes since commit 26c439d4005d94b8da28e023e285fd4a9943470e:
  Linus Torvalds (1):
        Merge tag 'ecryptfs-3.5-rc6-fixes' of git://git.kernel.org/.../tyhicks/ecryptfs

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git for-linus

Andy Lutomirski (1):
      security: Minor improvements to no_new_privs documentation

 Documentation/prctl/no_new_privs.txt |    7 +++++++
 include/linux/prctl.h                |    2 ++
 2 files changed, 9 insertions(+)

commit c540521bba5d2f24bd2c0417157bfaf8b85e2eee
Author: Andy Lutomirski <luto@...capital.net>
Date:   Thu Jul 5 11:23:24 2012 -0700

    security: Minor improvements to no_new_privs documentation
    
    The documentation didn't actually mention how to enable no_new_privs.
    This also adds a note about possible interactions between
    no_new_privs and LSMs (i.e. why teaching systemd to set no_new_privs
    is not necessarily a good idea), and it references the new docs
    from include/linux/prctl.h.
    
    Suggested-by: Rob Landley <rob@...dley.net>
    Signed-off-by: Andy Lutomirski <luto@...capital.net>
    Acked-by: Kees Cook <keescook@...omium.org>
    Signed-off-by: James Morris <james.l.morris@...cle.com>

diff --git a/Documentation/prctl/no_new_privs.txt b/Documentation/prctl/no_new_privs.txt
index cb705ec..f7be84f 100644
--- a/Documentation/prctl/no_new_privs.txt
+++ b/Documentation/prctl/no_new_privs.txt
@@ -25,6 +25,13 @@ bits will no longer change the uid or gid; file capabilities will not
 add to the permitted set, and LSMs will not relax constraints after
 execve.
 
+To set no_new_privs, use prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0).
+
+Be careful, though: LSMs might also not tighten constraints on exec
+in no_new_privs mode.  (This means that setting up a general-purpose
+service launcher to set no_new_privs before execing daemons may
+interfere with LSM-based sandboxing.)
+
 Note that no_new_privs does not prevent privilege changes that do not
 involve execve.  An appropriately privileged task can still call
 setuid(2) and receive SCM_RIGHTS datagrams.
diff --git a/include/linux/prctl.h b/include/linux/prctl.h
index 3988012..289760f 100644
--- a/include/linux/prctl.h
+++ b/include/linux/prctl.h
@@ -141,6 +141,8 @@
  * Changing LSM security domain is considered a new privilege.  So, for example,
  * asking selinux for a specific new context (e.g. with runcon) will result
  * in execve returning -EPERM.
+ *
+ * See Documentation/prctl/no_new_privs.txt for more details.
  */
 #define PR_SET_NO_NEW_PRIVS	38
 #define PR_GET_NO_NEW_PRIVS	39
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/