linux-kernel - Re: [PATCH] userns/capability: Add user namespace capability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <562417EE.4070602@nod.at>
Date:	Mon, 19 Oct 2015 00:06:38 +0200
From:	Richard Weinberger <richard@....at>
To:	Tobias Markus <tobias@...lix.eu>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Al Viro <viro@...iv.linux.org.uk>,
	Serge Hallyn <serge.hallyn@...onical.com>,
	Andrew Morton <akpm@...uxfoundation.org>,
	Andy Lutomirski <luto@...capital.net>,
	Christoph Lameter <cl@...ux.com>,
	"Michael Kerrisk (man-pages)" <mtk.manpages@...il.com>,
	LSM <linux-security-module@...r.kernel.org>,
	"open list:ABI/API" <linux-api@...r.kernel.org>,
	linux-man <linux-man@...r.kernel.org>
Subject: Re: [PATCH] userns/capability: Add user namespace capability

Am 18.10.2015 um 23:49 schrieb Tobias Markus:
> But before we continue arguing endlessly, I just got an idea: What about
> adding a sysctl to enable/disable enforcement of the hypothetical
> CAP_SYS_USER_NS, just like with /proc/sys/kernel/kptr_restrict and
> CAP_SYSLOG? Would also prevent any potential userspace breakage.

My argument stands, hiding user namespaces behind whatever
switch and rendering it into a second class citizen does not improve its security.

Especially ad-hoc solutions are not expedient. Reducing the attack surface must not
lead to gazillions of new capabilities, sysctl switches, etc...
user namespaces are neither the first nor the last "critical" kernel feature.

I'm sure RHEL will ship a SELinux boolean to disable user namespaces as they do
for many other OS features. This is fine and exactly why we have LSM.

Thanks,
//richard
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/