linux-kernel - Re: [PATCH] ptrace: allow restriction of ptrace scope

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100617233054.330256cf@lxorguk.ukuu.org.uk>
Date:	Thu, 17 Jun 2010 23:30:54 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Kees Cook <kees.cook@...onical.com>
Cc:	Randy Dunlap <rdunlap@...otime.net>,
	James Morris <jmorris@...ei.org>, linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	Jiri Kosina <jkosina@...e.cz>,
	Dave Young <hidave.darkstar@...il.com>,
	Martin Schwidefsky <schwidefsky@...ibm.com>,
	Roland McGrath <roland@...hat.com>,
	Oleg Nesterov <oleg@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	David Howells <dhowells@...hat.com>,
	Ingo Molnar <mingo@...e.hu>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	linux-doc@...r.kernel.org, Stephen Smalley <sds@...ho.nsa.gov>,
	Daniel J Walsh <dwalsh@...hat.com>,
	linux-security-module@...r.kernel.org
Subject: Re: [PATCH] ptrace: allow restriction of ptrace scope

> The "just use SELinux" reply is tiresome.  If "everyone" used SELinux,
> there wouldn't be at least 3 other LSMs under active development.

People using SELinux, SMACK and the other LSMs already *have* this
feature (done right, unlike the version you posted).

> The PTRACE, symlink, and other stuff are features people want.  If the
> point of your argument is that the logic and configuration for each
> of these features should be added to every LSM, that's not sensible.
> An end user should be able to pick and choose what they want.  If I
> create the security/hideous/ LSM tree, it would _exclude_ the ability to
> use TOMOYO or Smack or SELinux or AppArmor.

This is like trying to have two different file systems on the same
partition at once. We tried stackability - the reason LSMs don't currently
stack neatly is because it turned out to be a very bad idea.

If you want to fix that by implementing a stacking LSM which has your
switches then do that.

> At present, I'm aware of global PTRACE control being possible in SELinux,
> AppArmor, grsecurity, and as a patch in Ubuntu's kernel.  I don't know
> about TOMOYO or Smack, but configuring the default scope of PTRACE in
> at least 4 different ways so far (or not being able to change it at all)
> just seems crazy.

So you want to add a fifth. It won't replace the others because its not
as flexible. How does having five help ?

> If the security API allowed the end user to pick and choose the features
> they wanted, then those features would be developed in a single place
> and configured in a single way.  Since that's not possible, I'm proposing
> these features be central, and configured via /proc/sys.

They *are* central, which is why we have the security directory and the
security hooks abstracted into one central location.

So if you care about everyone then do it right - put it in its own LSM.
After that or in parallel you can look at how it needs to interact to
make it stackable. That's a door that the integrity/ima work has partly
re-opened already.

Really you have three choices

- You can keep trying to put stuff in places it doesn't belong, in which
  case you'll keep getting NAKs from people like Christoph and from Al
  Viro and then give up.

- You can give up now.

- You can put it together as a security module - which will make people
  happy and get your stuff upstream. After that you can have a meaningful
  discussion about stacking, although I think you'll find that stacking
  is really really hard because you get conflicting behaviour between
  security modules and ignoring those conflicts ends up violating at least
  one of the security models leaving you worse not better off.

Your path to making any of the stuff you want happen is via the security
layer and the LSM hooks. Even if you want them stackable and usable with
other modules your starting point is still a security module.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/