linux-kernel - Re: [PATCH] binfmt_misc: allow selecting the interpreter based on xattr keywords

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 27 Aug 2016 12:52:30 +0100
From:   One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
To:     James Bottomley <James.Bottomley@...senPartnership.com>
Cc:     Florian Weimer <fweimer@...hat.com>,
        Josh Max <JMax@...l.greenriver.edu>, viro@...iv.linux.org.uk,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        "Carlos O'Donell" <carlos@...hat.com>
Subject: Re: [PATCH] binfmt_misc: allow selecting the interpreter based on
 xattr keywords

On Fri, 26 Aug 2016 17:26:18 -0400
James Bottomley <James.Bottomley@...senPartnership.com> wrote:

> On Fri, 2016-08-26 at 22:12 +0100, One Thousand Gnomes wrote:
> > > A non-security use case would be to run the binary (without 
> > > modification) with a different ELF interpreter (assuming this 
> > > allows to override binfmt_elf, but self-sandboxing would need that 
> > > as well).  This would make it easier to use older or newer libcs 
> > > for select binaries on the system.  Right now, one has to write 
> > > wrappers for that, and the explicit dynamic linker invocation is 
> > > not completely transparent to the application.  
> > 
> > If it gets in I'll be using it to label CP/M COM files so that they 
> > can be auto-run nicely when crossbuilding stuff in part with the 
> > original tools but a modern build environment 8)
> > 
> > Sandboxing is an obvious use but there are more bizarre ones such as
> > marking a file system image to get auto-run under a virtual machine 
> > or make containers fire up as if they were commands.  
> 
> So I asked previously but didn't get an answer.  If this is useful for
> sandboxing and being in the sandbox depends on the xattr value,
> shouldn't it be in one of the privileged xattr namespaces, not the
> user. one?

IMHO no 

- because it's not giving additional rights, it is taking rights away
  voluntarily
- because as a user I can simply cp the file to get an unsandboxed version

If it was a setuid like bit then yes it would matter.

Alan