linux-kernel - Re: [GIT PULL] LSM patches for v6.1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHk-=wiCqicQrnQPeHbDF7ECKHk_ceYzZK5dYq7y5nZTZhpB8g@mail.gmail.com>
Date:   Tue, 4 Oct 2022 13:55:17 -0700
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>
Cc:     Paul Moore <paul@...l-moore.com>,
        linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [GIT PULL] LSM patches for v6.1

On Tue, Oct 4, 2022 at 1:37 PM Eric W. Biederman <ebiederm@...ssion.com> wrote:
>
> Please don't pull the user namespace bits of this code.

Eric, already done.

And I think you are in denial about how many problems the
user-namespace stuff has caused.

Distros are literally turning it off entirely because the whole "let
users create their own namespace" has *NOT* been a great success.

I personally think it was a mistake. We're stuck with it, but we most
definitely need knobs to manage it that isn't just "enable/disable
USER_NS" in the kernel config.

So this whole "don't do this" approach you have is not acceptable.

99% of all code does NOT WANT the user namespace thing, and it's been
a big new attack surface for the kernel getting things subtly wrong.

I do not understand your "people need to be able to do this with no
controls", when the alternative is to literally turn it off ENTIRELY.

I'm not saying that an LSM is the only place to do it, but I don't
think there have been any better suggestions either.

Put another way: your "no limits are acceptable" is simply not
realistic, and you haven't given any sane alternatives that I am aware
of. No way to say "sure, let trusted system apps create their
namespaces, but not random things".

                Linus