linux-kernel - Re: [PATCH v2] userns: improve uid/gid map collision detection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 24 Jan 2013 18:00:47 -0800
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Aristeu Rozanski <aris@...hat.com>, linux-kernel@...r.kernel.org,
	"Serge E. Hallyn" <serge@...lyn.com>
Subject: Re: [PATCH v2] userns: improve uid/gid map collision detection

I will look at this patch in a bit.  I already have a similar patch
in my queue, although I don't know if I have pushed that out yet.

Andrew Morton <akpm@...ux-foundation.org> writes:

> btw, what the heck is up with CONFIG_UIDGID_CONVERTED?  That thing
> prevents userns from being compiled in an allmodconfig build, which is
> rather undesirable.  Isn't there a better, more user-friendly way of
> doing this?

CONFIG_UIDGID_CONVERTED is what keeps the allmodconfig building with user
namespaces enabled.

The practical issue is that the uid_t, gid_t converstion to kuid_t and
kgid_t is not quite done.  And it takes a lot of pain staking review in
some cases to get it done.

In places where the conversion is not complete the code fails to compile
preventing the introduction of security holes.

If you look in init/Kconfig at the definition of CONFIG_UIDGID_CONVERTED
you see the list of filesystems that still need changes.

I have the basic version of those changes queued up, and I believe those
changes are correct.  However I need to break them into smaller patches
to make the changes obviously correct.  One of the things I have
discovered along the way of making these conversions is that I need to
push kuid_t and kgid_t as deep and as thoroughly into the code as I can
or I will fail to place conversions where they need to be.

The amount of work required on those final pieces appears to be
proportional to the size of the filesystem rather than proportional to
the size of the changes to those filesystems.  Because there is so much
code that must be reviewed and understood.

I am hoping I can get the conversions done and CONFIG_UIDGID_CONVERTED
can be killed for 3.9 but we will see.

Eric

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/