linux-kernel - Re: [RFC PATCH 5/8] KEYS: exec request-key within the requesting task's init namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1423187245.3299.37.camel@pluto.fritz.box>
Date:	Fri, 06 Feb 2015 09:47:25 +0800
From:	Ian Kent <ikent@...hat.com>
To:	David Howells <dhowells@...hat.com>
Cc:	Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Oleg Nesterov <onestero@...hat.com>,
	Trond Myklebust <trond.myklebust@...marydata.com>,
	"J. Bruce Fields" <bfields@...ldses.org>,
	Benjamin Coddington <bcodding@...hat.com>,
	Al Viro <viro@...IV.linux.org.uk>,
	Jeff Layton <jeff.layton@...marydata.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>
Subject: Re: [RFC PATCH 5/8] KEYS: exec request-key within the requesting
 task's init namespace

On Thu, 2015-02-05 at 15:14 +0000, David Howells wrote:
> 
> > +	/* If running within a container use the container namespace */
> > +	if (current->nsproxy->net_ns != &init_net)
> 
> Is that a viable check?  Is it possible to have a container that shares
> networking details?

That's up for discussion.

I thought about it and concluded that the check is probably not
sufficient for any of the cases.

I left it like that because I'm not sure exactly what the use cases are,
hoping it promote discussion and here we are.

I also think the current container environments don't share net
namespace with the root init net namspace, necessarily, because thy are
containers, ;)

TBH I haven't looked at the user space container creation code but I
expect it could be done that way if it was needed, so the answer is yes
and no, ;)

The questions then are do we need to check anything else, and what
environment should the callback use in the different cases, and what
other cases might break if we change it?

For example, should the fs namespace also be checked for all of these
cases, since we're executing a callback, or is whatever that's set to in
the container always what's required for locating the executable.

Ian

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/