linux-kernel - Re: [RFC] Privilege dropping security module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <h9g795$9om$1@taverner.cs.berkeley.edu>
Date:	Thu, 24 Sep 2009 16:37:57 +0000 (UTC)
From:	daw@...berkeley.edu (David Wagner)
To:	linux-kernel@...r.kernel.org
Subject: Re: [RFC] Privilege dropping security module

Andy Spencer  wrote:
>Being able to use dpriv as a non root user is pretty strait forward. For
>example, a user of a multi-user system may want to try some untrusted
>code without risking access to the rest of the system:
>
>  $ cd ~/my_project
>  $ echo rxRX   /                > /sys/kernel/security/dpriv/stage
>  $ echo X      $HOME            > /sys/kernel/security/dpriv/stage
>  $ echo rwxRWX $HOME/my_project > /sys/kernel/security/dpriv/stage
>  $ echo commit                  > /sys/kernel/security/dpriv/control
>  $ patch < untrusted.patch
>  $ make && ./src/some_exe

If I understand correctly, this isn't sufficient to run untrusted code,
because it only restricts access to the filesystem.  You gotta restrict
access to the network, interaction with other processes, and so on.
(For instance, does dpriv let the untrusted process take over another of
your processes using ptrace?)

There's a tremendous amount of research literature on building secure
sandboxes.  You should study it, if you're not familiar with it.

I suspect making all permissions recursive is going to lead to overly
permissive policies.  Suppose I want to allow read access to everything
under /lib and /usr/lib, read-execute access to everything under /bin
and /usr/bin, and read-write access to everything under /tmp.  (But I
do not want to allow any access to any other directories.)  How do I
do it?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/