linux-kernel - Re: [PATCH RFC] allow some kernel filesystems to be mounted in a user namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrV8QFZU947=OjL-abxAmHiLso-uhbmoJt45kfmtaw26Tg@mail.gmail.com>
Date:	Tue, 16 Jul 2013 14:44:20 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	"Serge E. Hallyn" <serge@...lyn.com>
Cc:	Al Viro <viro@...iv.linux.org.uk>,
	Serge Hallyn <serge.hallyn@...ntu.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH RFC] allow some kernel filesystems to be mounted in a user namespace

On Tue, Jul 16, 2013 at 2:37 PM, Serge E. Hallyn <serge@...lyn.com> wrote:
> Quoting Andy Lutomirski (luto@...capital.net):
>> On 07/16/2013 12:50 PM, Serge E. Hallyn wrote:
>> > Quoting Al Viro (viro@...IV.linux.org.uk):
>> >> On Tue, Jul 16, 2013 at 02:29:20PM -0500, Serge Hallyn wrote:
>> >>> All the files will be owned by host root, so there's no security
>> >>> concern in allowing this.
>> >>
>> >> Files owned by root != very bad things can't be done by non-root.
>> >> Especially for debugfs, which is very much a "don't even think about
>> >> mounting that on a production box" thing...
>> >
>> > I would prefer it not be mounted.  But near as I can tell there
>> > should be no regression security-wise whether an unprivileged
>> > user on the host has access to it, or whether a user in a
>> > non-init user ns is allowed to mount it.  (Obviously I could very
>> > well be wrong)
>>
>> I would argue that either (a) debugfs denies everything to non-root, so
>> mounting it in a (rootless) userns is useless or (b) it doesn't, in
>> which case it's dangerous.
>>
>> In neither case does it make sense to me to allow the mount.
>
> It makes sense from the POV of having sane user-space.  I can obviously
> work around this by tweaking a stock container rootfs to be different
> from a stock host rootfs.  It is undesirable.
>
> For debug and fusectl there is another option which I'm happy to
> pursue, namely tweaking how mountall handles 'nofail' to ignore these
> errors.

I don't know enough about fuse to know whether it should work in a
container, but presumably the fusectl FS needs to be aware of userns
mappings for it to work right.  But ISTM it would be better for
containers to be smart enough to keep going if debugfs fails to mount
-- this really seems like a userspace problem that ought to be fixed
in userspace.

>
> But for /sys/kernel/security, the failure of which to mount on a
> non-container can be a real problem, that is not good enough.  So
> at least I'd like securityfs to be mountable in a non-init userns.
>

Will the container work if /sys/kernel/security is inaccessible even to "root"?

> -serge



-- 
Andy Lutomirski
AMA Capital Management, LLC
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/