linux-kernel - Re: Building a BSD-jail clone out of namespaces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 06 Jun 2013 09:56:10 -0700
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Chris Webb <chris@...chsys.com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: Building a BSD-jail clone out of namespaces

Chris Webb <chris@...chsys.com> writes:

> "Eric W. Biederman" <ebiederm@...ssion.com> writes:
>
>> That will work, but you really don't want to run with uid == 0 mapped to
>> uid == 0.  There are too many things in /proc and /sys and similar that
>> grant access to uid == 0.
>
> Many thanks for the swift reply. If I map UID zero in the userns to a
> non-zero UID outside (say -1), is there any way to use the userns UIDs
> instead of host UIDs when accessing the container's root filesystem so I
> don't end up with strange file ownerships on disk? This would prevent me
> from using the same filesystem on physical hosts or in VMs.

Hmm.  I guess it depends on how your VM is reading them.  If it is
blocked based access to the filesystem you have a problem.   If the VM
is effectively NFS mounting the filesystem you can do all kinds of
things.

It is possible to just change the user namespace and setup your mapping,
effectively running your VM in the user namespace, and that would allow
the VM to see your mapped uids.

> I don't think there's any kernel mechanism that lets me apply a UID
> translation layer as part of a bind mount is there?

No.  In principle you could mount the filesystem inside of the user
namespace but in practice no filesystems support that yet.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/