linux-kernel - Re: user ns: arbitrary module loading

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5jLciqXcuhzDVPKPqA+mwv8e28zGAMScatzov3U07BuBaQ@mail.gmail.com>
Date:	Sat, 2 Mar 2013 17:18:17 -0800
From:	Kees Cook <keescook@...gle.com>
To:	"Serge E. Hallyn" <serge@...lyn.com>
Cc:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Serge Hallyn <serge.hallyn@...onical.com>,
	Brad Spengler <spender@...ecurity.net>,
	Al Viro <viro@...iv.linux.org.uk>,
	Eric Paris <eparis@...hat.com>,
	Rusty Russell <rusty@...tcorp.com.au>
Subject: Re: user ns: arbitrary module loading

On Sat, Mar 2, 2013 at 4:57 PM, Serge E. Hallyn <serge@...lyn.com> wrote:
> Quoting Kees Cook (keescook@...gle.com):
>> The rearranging done for user ns has resulted in allowing arbitrary
>> kernel module loading[1] (i.e. re-introducing a form of CVE-2011-1019)
>> by what is assumed to be an unprivileged process.
>>
>> At present, it does look to require at least CAP_SETUID along the way
>> to set up the uidmap (but things like the setuid helper newuidmap
>> might soon start providing such a thing by default).
>>
>> It might be worth examining GRKERNSEC_MODHARDEN in grsecurity, which
>> examines module symbols to verify that request_module() for a
>> filesystem only loads a module that defines "register_filesystem"
>> (among other things).
>>
>> -Kees
>>
>> [1] https://twitter.com/grsecurity/status/307473816672665600
>
> So the concern is root in a child user namespace doing
>
>         mount -t randomfs <...>
>
> in which case do_new_mount() checks ns_capable(), not capable(),
> before trying to load a module for randomfs.

Well, not just randomfs. Any module that modprobe in the init ns can find.

> As well as (secondly) the fact that there is no enforcement on
> the format of the module names (i.e. fs-*).
>
> Kees, from what I've seen the GRKERNSEC_MODHARDEN won't be acceptable.
> At least Eric Paris is strongly against it.

I'd be curious to hear the objections. It seems pretty nice to me to
add a new argument to every request_module() that specifies the
"subsystem" it expects a module to load from. Maybe pass
"request_module=filesystem" or "...=netdev" to the modprobe call. And
then in init_module(), check the userargs for which subsystem was
requested and look up in a table for the entry point module symbol for
that subsystem to require. e.g. for "request_module=filesystem",
require that the module contains the "register_filesystem" symbol,
etc.

> But how about if we
> add a check for 'current_user_ns() == &init_user_ns' at that place
> instead?

Well, we'd need to mostly revert
57eccb830f1cc93d4b506ba306d8dfa685e0c88f ("mount: consolidate
permission checks") since get_fs_type() is being called before
may_mount() right now. (And then, as you suggest, we should strengthen
the test.) I think this will require either more plumbing into
get_fs_type (something like "bool load_module_if_missing") or the
subsystem verification stuff in request_module. I think the latter is
MUCH nicer as it covers this problem in all places, not just this
"mount" case.

> Eric Biederman, do you have any objections to that?
>
> thanks,
> -serge

-Kees

--
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/