lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <56AA0F62.7090905@gmail.com>
Date:	Thu, 28 Jan 2016 07:53:54 -0500
From:	"Austin S. Hemmelgarn" <ahferroin7@...il.com>
To:	"Serge E. Hallyn" <serge.hallyn@...ntu.com>,
	kernel-hardening@...ts.openwall.com
Cc:	Kees Cook <keescook@...omium.org>,
	Andy Lutomirski <luto@...capital.net>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Al Viro <viro@...iv.linux.org.uk>,
	Richard Weinberger <richard@....at>,
	Robert Święcki <robert@...ecki.net>,
	Dmitry Vyukov <dvyukov@...gle.com>,
	David Howells <dhowells@...hat.com>,
	Miklos Szeredi <mszeredi@...e.cz>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Eric Dumazet <edumazet@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>,
	"linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to
 be disabled

On 2016-01-28 03:56, Serge E. Hallyn wrote:
> On Mon, Jan 25, 2016 at 10:57:32PM -0600, Eric W. Biederman wrote:
>> What sounds like a generally useful feature that would cover your use
>> case and many others is a per user limit on the number of user
>> namespaces users may create.
>
> Ok, I'm sorry, but after thinking about this quite awhile, I think this
> is a bad idea.  If I'm allowed to create exactly one, then (a) I won't
> be able to run two instances of chrome (does chrome use one userns per
> tab or per application?), yet (b) i can easily just not use chrome and
> use my allocation to run a vulnerability.
Ignore regular users WRT the ability to limit to one or two namespace 
instances, the advantage of being able to limit to one or two user 
namespaces for a given user is that it prevents daemons that use it for 
sand-boxing from being exploited to create more.  If we go with Eric's 
suggestion, there is absolutely no reason on a regular desktop system 
that the users used for a graphical login would have to be limited.
>
> IMO, having a (hopefully temporary, so cleanly separated out) sysctl,
> which perhaps goes so far as to kill all non-init user namespaces when
> set to -1, makes the most sense.  I still think the harm due to having
> userspace not being able to rely on user namespaces will, long term, be
> worse than the security implications of having user namespaces always
> enabled.
Userspace can't rely on them as it is right now.  The default kernel 
config has them disabled, and a number of distros are refusing to ship 
kernels with them enabled at least in the short term, wheras a number 
are only shipping kernels with them enabled (I'd be willing to bet that 
part of what prompted this originally was Chrome).  Just by virtue of 
this, you can't rely on them being there and need to gracefully handle 
the situation if they aren't.  Adding a sysctl allowing them to be 
disabled completely on a kernel that has support built in would not make 
them all that much more unreliable than they already are.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ