linux-kernel - Re: [PATCH RFC] allow some kernel filesystems to be mounted in a user namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87d2qh91xm.fsf@xmission.com>
Date:	Tue, 16 Jul 2013 22:43:17 -0700
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	"Serge E. Hallyn" <serge@...lyn.com>
Cc:	Andy Lutomirski <luto@...capital.net>,
	Al Viro <viro@...iv.linux.org.uk>,
	Serge Hallyn <serge.hallyn@...ntu.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH RFC] allow some kernel filesystems to be mounted in a user namespace

"Serge E. Hallyn" <serge@...lyn.com> writes:

> I'm not "relying on LSM" to make these safe.  I'm relying on the
> uid mappings to make these safe.
>
> Nevertheless I at least have hope of working around the others (in a
> distro-acceptable way), so if the others are too scary I'll pursue
> the workaround for the others and see where I get.  But I really feel
> the securityfs one is the best solution.

Personally I don't trust debugfs enough to compile it into my kernel.

fuse simply isn't ready to be have fresh mounts usefully created inside
a user namespace.

Fundamentally with debugfs and securityfs you run into the issue we saw
with sysfs and proc where at some level it is the system administrators
perogative if those filesystems should be mounted.

The rule with filesystems like that is mounting them needs to be no more
dangerous than bind mounting them.  At the point in the cycle you are
talking about mounting them you presumably have already thrown away
their original mounts making it impossible to tell if it would have been
safe to mount them or not.  Making your patch completely inappropriate.

What you need to do is at container setup time to bind mount those
filesystems if they are already mounted and you want them in the
container.  If you are just shuffling around something you can already
see there are no security issues.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/