linux-kernel - Re: [RFC v2 v2 1/1] ns: add binfmt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAG48ez3OrkmBUyL6pS=bSHL-NzdPP8z-tD6hSDYDGyL_R25XDg@mail.gmail.com>
Date:   Wed, 3 Oct 2018 21:26:56 +0200
From:   Jann Horn <jannh@...gle.com>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>
Cc:     Laurent Vivier <laurent@...ier.eu>,
        kernel list <linux-kernel@...r.kernel.org>, dima@...sta.com,
        Andrei Vagin <avagin@...nvz.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        James Bottomley <James.Bottomley@...senpartnership.com>,
        containers@...ts.linux-foundation.org,
        linux-fsdevel@...r.kernel.org,
        Linux API <linux-api@...r.kernel.org>
Subject: Re: [RFC v2 v2 1/1] ns: add binfmt_misc to the mount namespace

On Wed, Oct 3, 2018 at 8:07 AM Eric W. Biederman <ebiederm@...ssion.com> wrote:
> Laurent Vivier <laurent@...ier.eu> writes:
> > This patch allows to have a different binftm_misc configuration
> > in each container we mount binfmt_misc filesystem with mount namespace
> > enabled.
> >
> > A container started without the CLONE_NEWNS will use the host binfmt_misc
> > configuration, otherwise the container starts with an empty binfmt_misc
> > interpreters list.
> >
> > For instance, using "unshare" we can start a chroot of an another
> > architecture and configure the binfmt_misc interpreted without being root
> > to run the binaries in this chroot.
>
> A couple of things.
> As has already been mentioned on your previous version anything that
> comes through the filesystem interface needs to lookup up the local
> binfmt context not through current but through file->f_dentry->d_sb.
> AKA the superblock of the mounted filesystem.

Something else: bm_register_write() currently calls into open_exec(),
which uses the credentials of current. That's not really allowed in
this context - but so far, it's not a big deal because only
init-namespace root can reach this code. Before you expose this stuff
to unprivileged userspace, this needs to get fixed; perhaps by
wrapping the open_exec() call in override_creds(file->f_cred) and
revert_creds().