linux-kernel - Re: [PATCH] devpts: Add ptmx_uid and ptmx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 31 Mar 2015 16:07:28 +0300
From:	James Bottomley <James.Bottomley@...senPartnership.com>
To:	Alexander Larsson <alexl@...hat.com>
Cc:	Andy Lutomirski <luto@...capital.net>, gnome-os-list@...me.org,
	Linux Containers <containers@...ts.linux-foundation.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	mclasen@...hat.com, "Eric W. Biederman" <ebiederm@...ssion.com>,
	Linux FS Devel <linux-fsdevel@...r.kernel.org>
Subject: Re: [PATCH] devpts: Add ptmx_uid and ptmx_gid options

On Tue, 2015-03-31 at 09:57 +0200, Alexander Larsson wrote:
> On fre, 2015-03-27 at 10:03 +0100, James Bottomley 
> > 
> > > On Fri, Feb 20, 2015 at 5:04 PM, Andy Lutomirski <luto@...capital.net> wrote:
> > > > It's currently impossible to mount devpts in a user namespace that
> > > > has no root user, since ptmx can't be created.
> > 
> > This is where I stopped reading because it's not true ... because it is
> > possible, you just do it from the host as real root.
> 
> The point is being able to set up a container as a user, not requiring
> the setup to be run as root at all. In my case container is a desktop
> application which will be started by the user, and will run as the user.
> There is no root involved in the call chain at all.

I don't really like that use case:  Most container setups are under the
control of an orchestration system (like LXC, OpenVZ or even Docker).
You typically get the orchestration system to do the dangerous
operations (mount being one of the bigger dangers) because it has the
capacity to vet them.  I can see the value in allowing a user to set up
a container without an oversight system, but at the same time you're
increasing the security vulnerability of the system.  Security is often
a result of policy, so now this embeds policy into the kernel.  I
strongly feel we should define the list of things we expect an
unsupervised (as in with no orchestration system) container to do and
then revisit this once we've given it some thought.

James

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/