linux-kernel - Re: [RFC] kconfig: add hardened defconfig helpers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 20 Jul 2018 08:37:04 -0500
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     Salvatore Mesoraca <s.mesoraca16@...il.com>
Cc:     Kernel Hardening <kernel-hardening@...ts.openwall.com>,
        Laura Abbott <labbott@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Masahiro Yamada <yamada.masahiro@...ionext.com>,
        linux-doc@...r.kernel.org, Kees Cook <keescook@...omium.org>
Subject: Re: [RFC] kconfig: add hardened defconfig helpers

Kees Cook <keescook@...omium.org> writes:

>> +CONFIG_USER_NS=n
>> +~~~~~~~~~~~~~~~~
>> +
>> +**Negative side effects level:** Medium
>
> Unfortunately I think this is High or Extreme. USER_NS gets a lot of use.
>
>> +**- Protection type:** Attack surface reduction
>> +
>> +This allows containers to use user namespaces to provide different
>> +user info for different servers.
>> +User namespaces have been abused in the past for privilege
>> +escalation.

This is not a particularly good description.

User namespaces do indeed increase the attack surface of programs that
don't use them.

User namespaces when used to build ``unprivileged containers'' remove or
at least drastically reduce the need to run as root when setting up
containers.  Which is attack surface reduction.

User namespaces make available tools that are commonly used to build
sandboxes.  Chrome for example uses users namespaces if they are
available as part of setting up it's sandbox.

User namespaces are not limited to containers.

The bugs in the attack surface that user namespaces expose that have
been used for privilege escalation have to the best of my knowledge
closed.  So while there is some danger in the increased attack surface
we are looking at implementation defects rather than design defects.

Eric