linux-kernel - Re: [PATCH] binfmt_misc: allow selecting the interpreter based on xattr keywords

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 25 Aug 2016 12:15:35 -0400
From:   James Bottomley <James.Bottomley@...senPartnership.com>
To:     Josh Max <JMax@...l.greenriver.edu>, viro@...iv.linux.org.uk
Cc:     linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] binfmt_misc: allow selecting the interpreter based on
 xattr keywords

On Sun, 2016-08-21 at 21:01 -0700, Josh Max wrote:
> This patch allows binfmt_misc to select the interpeter for arbitrary
> binaries by comparing a specified registered keyword with the value
> of a specified binary's extended attribute (user.binfmt.interp),
> and then launching the program with the registered interpreter.
> 
> This is useful when wanting to launch a collection of binaries under
> the same interpreter, even when they do not necessarily share a 
> common extension or magic bits, or when their magic conflics with the
> operation of binfmt_elf. Some examples of its use would be to launch 
> some executables of various different architectures in a directory, 
> or for running some native binaries under a sandbox (like firejail) 
> automatically during their launch.

Could you expand on the use cases?  The patch set looks OK; the issue
with extended attributes is lack of universal support on filesystems,
but that may not be a problem because they're definitely supported on
all the standard ones.  I think the current F flag solves the foreign
binary in chroot or container.  Self sandboxing sounds reasonable, but
if this is a security feature, doesn't having the label under the user.
EAs mean that the confined binary can simply remove the label and
unconfine itself?

James