linux-kernel - Re: ioctl CAP_LINUX_IMMUTABLE is checked in the wrong namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87ha5bntqm.fsf@x220.int.ebiederm.org>
Date:	Wed, 30 Apr 2014 00:48:01 -0700
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Theodore Ts'o <tytso@....edu>
Cc:	Serge Hallyn <serge.hallyn@...ntu.com>,
	Andy Lutomirski <luto@...capital.net>,
	Marian Marinov <mm@...com>,
	containers@...ts.linux-foundation.org,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	lxc-devel <lxc-devel@...ts.sourceforge.net>
Subject: Re: ioctl CAP_LINUX_IMMUTABLE is checked in the wrong namespace

Theodore Ts'o <tytso@....edu> writes:

> On Wed, Apr 30, 2014 at 12:16:41AM +0000, Serge Hallyn wrote:
>> I forget the details, but there was another case where I wanted to
>> have the userns which 'owns' the whole fs available.  I guess we'd
>> have to check against that instead of using inode_capable.
>
> Yes, that sounds right.
>
> And *please* tell me that that under no circumstances can anyone other
> than root@...t_user_ns is allowed to use mknod....

Nope.  mknod not allowed.  capable(CAP_MKNOD) is required is required
and I can't see any reason to change that.

As a rule of thumb, the only additional actions allowed in a user
namespace above and beyond what an ordinary unpriviliged user would be
allowed to do are those things which we only don't allow because they
could confuse a setuid root executable.

If we ever allow the creation of immutable files by unprivileged users
those files would at least have to be kept completely separate from the
files the global root encounters (aka a disjoint mount namespace).

I do not currently see a path to safely using immutable files with just
user namespace root permission.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/