linux-kernel - Re: Capabilities are list when creating a user namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAOGVgQF2Pmcpei1RqMk+Kbk6VFXksdKmYcKG-1bxanRWia82zA@mail.gmail.com>
Date:   Thu, 4 Jun 2020 08:58:08 +0300
From:   Idan Yadgar <idanyadgar@...il.com>
To:     dhowells@...hat.com
Cc:     gregkh@...uxfoundation.org, tglx@...utronix.de,
        allison@...utok.net, armijn@...ldur.nl,
        linux-kernel@...r.kernel.org
Subject: Re: Capabilities are list when creating a user namespace

Hello, sorry for duplicating the previous email, forgot to send it to
the mailing lists as well.
Did you miss my email?

Idan Yadgar.

On Fri, May 29, 2020 at 5:48 PM Idan Yadgar <idanyadgar@...il.com> wrote:
>
> Hello, did you miss my mail?
>
> בתאריך יום א׳, 24 במאי 2020, 15:32, מאת Idan Yadgar ‏<idanyadgar@...il.com>:
>>
>> Hello,
>>
>> A process which changes its user namespace (unshare or setns), or a
>> process that is created by clone with the CLONE_NEWUSER flag has all
>> capabilities inside the new namespace, and loses all its capabilities
>> in the parent/previous user namespace.
>> This poses an issue because some operations require a capability in a
>> user namespace other then the current one for the process. The man
>> states multiple times that a system call requires a capability in the
>> initial user namespace (for example, open_by_handle_at requires
>> CAP_DAC_READ_SEARCH in the initial user namespace), but this cannot
>> happen unless the process is owned by root, thus preventing
>> open_by_handle_at to be run inside a user namespace.
>>
>> Solving this problem can be done by allowing (via prctl or any other
>> mechanism) a task to save its
>> capabilities for a given user namespace, even when it isn't a member
>> in that namespace.
>>
>> We would like to hear some thoughts about this issue and our proposed solution.