linux-kernel - Re: Discuss the implementation of pidns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <202310091307.CB416B950@keescook>
Date:   Mon, 9 Oct 2023 13:08:05 -0700
From:   Kees Cook <keescook@...omium.org>
To:     yunhui cui <cuiyunhui@...edance.com>, brauner@...nel.org
Cc:     jeffxu@...gle.com, akpm@...ux-foundation.org, cyphar@...har.come,
        mcgrof@...nel.org, frederic@...nel.org,
        lkml - Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: Discuss the implementation of pidns_install()

On Wed, Sep 20, 2023 at 05:37:20PM +0800, yunhui cui wrote:
> Hi Kees, jeff, Andrew, Christian,
> 
> We hope that containers at the same level can also switch pid namespace.
> To fork() the entire pstree of a container, we need to switch from the pid
> namespace of the template container to the  target container's pid
> namespace. But it is blocked by the following code:
> 
> ...
>         while (ancestor->level > active->level)
>                 ancestor = ancestor->parent;
>         if (ancestor != active)
>                 return -EINVAL;
> ...
> 
> Can we give this code permission, such as CAP_SYS_ADMIN ..., so that those
> with this permission can switch to sibling pid namespace. Rather than just
> parent, parent ...
> 
> Do you think this plan is okay?  Or can you give me some suggestions?

I'll defer to Christian on this, but it seems like moving processes
sideways is kind of unexpected. I agree it'd need privilege if we did
it, though.

-- 
Kees Cook