linux-kernel - Re: [PATCH v5 next 1/5] modules:capabilities: add request_module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171130003531.gwpl22bxmweifjz2@thunk.org>
Date:   Wed, 29 Nov 2017 19:35:31 -0500
From:   Theodore Ts'o <tytso@....edu>
To:     "Serge E. Hallyn" <serge@...lyn.com>
Cc:     David Miller <davem@...emloft.net>, gnomes@...rguk.ukuu.org.uk,
        keescook@...omium.org, mcgrof@...nel.org, tixxdz@...il.com,
        luto@...nel.org, akpm@...ux-foundation.org,
        james.l.morris@...cle.com, ben.hutchings@...ethink.co.uk,
        solar@...nwall.com, jeyu@...nel.org, rusty@...tcorp.com.au,
        linux-kernel@...r.kernel.org,
        linux-security-module@...r.kernel.org,
        kernel-hardening@...ts.openwall.com, corbet@....net,
        mingo@...nel.org, netdev@...r.kernel.org, peterz@...radead.org,
        torvalds@...ux-foundation.org
Subject: Re: [PATCH v5 next 1/5] modules:capabilities: add
 request_module_cap()

On Wed, Nov 29, 2017 at 11:28:52AM -0600, Serge E. Hallyn wrote:
> 
> Just to be clear, module loading requires - and must always continue to
> require - CAP_SYS_MODULE against the initial user namespace.  Containers
> in user namespaces do not have that.
> 
> I don't believe anyone has ever claimed that containers which are not in
> a user namespace are in any way secure.

Unless the container performs some action which causes the kernel to
call request_module(), which then loads some kernel module,
potentially containing cr*p unmaintained code which was included when
the distro compiled the world, into the host kernel.

This is an attack vector that doesn't exist if you are using VM's.
And in general, the attack surface of the entire Linux
kernel<->userspace API is far larger than that which is exposed by the
guest<->host interface.

For that reason, containers are *far* more insecure than VM's, since
once the attacker gets root on the guest VM, they then have to attack
the hypervisor interface.  And if you compare the attack surface of
the two, it's pretty clear which is larger, and it's not the
hypervisor interface.

						- Ted