linux-kernel - Re: [PATCH net-next] net: Enable some sysctls for the userns root with privilege

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2f0757f8-797f-644b-50ee-0c1aef8fe865@fb.com>
Date:   Tue, 7 Dec 2021 14:16:43 -0800
From:   Joanne Koong <joannekoong@...com>
To:     CGEL <cgel.zte@...il.com>, Jakub Kicinski <kuba@...nel.org>
CC:     <davem@...emloft.net>, <alex.aring@...il.com>,
        <stefan@...enfreihafen.org>, <yoshfuji@...ux-ipv6.org>,
        <dsahern@...nel.org>, <horms@...ge.net.au>, <ja@....bg>,
        <pablo@...filter.org>, <kadlec@...filter.org>, <fw@...len.de>,
        <steffen.klassert@...unet.com>, <herbert@...dor.apana.org.au>,
        <daniel@...earbox.net>, <roopa@...dia.com>, <yajun.deng@...ux.dev>,
        <chinagar@...eaurora.org>, <xu.xin16@....com.cn>,
        <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <linux-wpan@...r.kernel.org>, <lvs-devel@...r.kernel.org>,
        <netfilter-devel@...r.kernel.org>, <coreteam@...filter.org>,
        Eric Biederman <ebiederm@...ssion.com>
Subject: Re: [PATCH net-next] net: Enable some sysctls for the userns root
 with privilege

On 12/6/21 11:18 PM, CGEL wrote:

> On Mon, Dec 06, 2021 at 04:45:20PM -0800, Jakub Kicinski wrote:
>> On Fri,  3 Dec 2021 03:28:15 +0000 cgel.zte@...il.com wrote:
>>> From: xu xin <xu.xin16@....com.cn>
>>>
>>> Enabled sysctls include the followings:
>>> 1. net/ipv4/neigh/<if>/*
>>> 2. net/ipv6/neigh/<if>/*
>>> 3. net/ieee802154/6lowpan/*
>>> 4. net/ipv6/route/*
>>> 5. net/ipv4/vs/*
>>> 6. net/unix/*
>>> 7. net/core/xfrm_*
>>>
>>> In practical work, some userns with root privilege have needs to adjust
>>> these sysctls in their own netns, but limited just because they are not
>>> init user_ns, even if they are given root privilege by docker -privilege.
>> You need to justify why removing these checks is safe. It sounds like
>> you're only describing why having the permissions is problematic, which
>> is fair but not sufficient to just remove them.
>>
> Hi, Jakub
> My patch is a little radical. I just saw Eric's previous reply to
> Alexander(https://lore.kernel.org/all/87pmsqyuqy.fsf@disp2133/).
> These were disabled because out of an abundance of caution.
>
> My original intention is to enable part of syscyls about neighbor which
> I think was safe, but I will try to figure out which of these sysctls
> are safe to be enabled.
>

A team at my company has a use case for needing to set the unix sysctls,
so I submitted a patch for enabling the unix sysctl here
https://lore.kernel.org/netdev/20211207202101.2457994-1-joannekoong@fb.com/T/#u

[...]
>>> Signed-off-by: xu xin <xu.xin16@....com.cn>
>>> ---
>>>   net/core/neighbour.c                | 4 ----
>>>   net/ieee802154/6lowpan/reassembly.c | 4 ----
>>>   net/ipv6/route.c                    | 4 ----
>>>   net/netfilter/ipvs/ip_vs_ctl.c      | 4 ----
>>>   net/netfilter/ipvs/ip_vs_lblc.c     | 4 ----
>>>   net/netfilter/ipvs/ip_vs_lblcr.c    | 3 ---
>>>   net/unix/sysctl_net_unix.c          | 4 ----
>>>   net/xfrm/xfrm_sysctl.c              | 4 ----
>>>   8 files changed, 31 deletions(-)
>