linux-kernel - Re: [PATCH] ipc: add set_ownership() and permissions() callbacks for posix mqueue sysctl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 29 Jul 2021 16:53:48 +0200
From:   Christian Brauner <christian.brauner@...ntu.com>
To:     cgel.zte@...il.com
Cc:     keescook@...omium.org, ktkhai@...tuozzo.com,
        jamorris@...ux.microsoft.com, varad.gautam@...e.com,
        legion@...nel.org, dbueso@...e.de, linux-kernel@...r.kernel.org,
        Ran Xiaokai <ran.xiaokai@....com.cn>
Subject: Re: [PATCH] ipc: add set_ownership() and permissions() callbacks for
 posix mqueue sysctl

On Wed, Jul 28, 2021 at 08:06:51PM -0700, cgel.zte@...il.com wrote:
> From: Ran Xiaokai <ran.xiaokai@....com.cn>
> 
> When a non-root user process creates a user namespace and ipc namespace
> with command "unshare -Ur -i", and map the root user inside
> the user namesapce to the global owner of user namespace.
> The newly created user namespace OWNS the ipc namespace,
> So the root user inside the user namespace should have full access
> rights to the ipc namespace resources.
> 
> $ id
> uid=1200(u1200) gid=1200(u1200) groups=1200(u1200)
> $ unshare -Ur -i
> $ id
> uid=0(root) gid=0(root) groups=0(root)
> $ ls -l /proc/sys/fs/mqueue/
> total 0
> -rw-r--r-- 1 65534 65534 0 Jul 28 19:03 msg_default
> -rw-r--r-- 1 65534 65534 0 Jul 28 19:03 msg_max
> -rw-r--r-- 1 65534 65534 0 Jul 28 19:03 msgsize_default
> -rw-r--r-- 1 65534 65534 0 Jul 28 19:03 msgsize_max
> -rw-r--r-- 1 65534 65534 0 Jul 28 19:03 queues_max
> -sh: /proc/sys/fs/mqueue/msg_max: Permission denied
> 
> As opposite, inside a net namespace,
> 1. sysctl files owners are set to the local root user
>    insede the user namespace, not the GLOBAL_ROOT_UID;
> 2. sysctl files are writable when accessed by root user
>    inside the user namespace.
> 
> $ id
> uid=1200(u1200) gid=1200(u1200) groups=1200(u1200)
> $ unshare -Ur -n
> $ id
> uid=0(root) gid=0(root) groups=0(root)
> $ ls -l /proc/sys/net/ipv4/ip_forward
> -rw-r--r-- 1 root root 0 Jul 28 19:04 /proc/sys/net/ipv4/ip_forward
> $ echo 1 > /proc/sys/net/ipv4/ip_forward
> $ cat /proc/sys/net/ipv4/ip_forward
> 1

Yeah, we did that work specifically for the network namespace but knew
there were quite a few places that would need fix up. This makes sense
to me.

Please add tests for this patch though. Also make sure to run them in a
tight loop on a kernel with memory and log debugging enabled. The whole
sysctl retire stuff can't be called from rcu contexts and that's easy to
miss. So turn on at least sm like:

CONFIG_HAVE_ARCH_KASAN=y
CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
CONFIG_CC_HAS_KASAN_GENERIC=y
CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
CONFIG_KASAN=y
CONFIG_KASAN_GENERIC=y
# CONFIG_KASAN_OUTLINE is not set
CONFIG_KASAN_INLINE=y
CONFIG_KASAN_STACK=1
CONFIG_KASAN_VMALLOC=y
# CONFIG_KASAN_MODULE_TEST is not set
CONFIG_HAVE_ARCH_KFENCE=y
CONFIG_KFENCE=y
CONFIG_KFENCE_STATIC_KEYS=y
CONFIG_KFENCE_SAMPLE_INTERVAL=100
CONFIG_KFENCE_NUM_OBJECTS=255
CONFIG_KFENCE_STRESS_TEST_FAULTS=0
CONFIG_LOCKDEP_SUPPORT=y
CONFIG_LOCKDEP=y