linux-kernel - Re: [External] Re: Discuss the implementation of pidns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAEEQ3wmH0u1p4gWX454Hx09m5=LQ_+3VPWiEHogn_QiS-po4BQ@mail.gmail.com>
Date:   Wed, 11 Oct 2023 09:46:52 +0800
From:   yunhui cui <cuiyunhui@...edance.com>
To:     Kees Cook <keescook@...omium.org>
Cc:     brauner@...nel.org, jeffxu@...gle.com, akpm@...ux-foundation.org,
        cyphar@...har.come, mcgrof@...nel.org, frederic@...nel.org,
        lkml - Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [External] Re: Discuss the implementation of pidns_install()

Hi Christian,

On Tue, Oct 10, 2023 at 11:29 AM yunhui cui <cuiyunhui@...edance.com> wrote:
>
> Hi Kees Cook，
>
> On Tue, Oct 10, 2023 at 4:08 AM Kees Cook <keescook@...omium.org> wrote:
> >
> > On Wed, Sep 20, 2023 at 05:37:20PM +0800, yunhui cui wrote:
> > > Hi Kees, jeff, Andrew, Christian,
> > >
> > > We hope that containers at the same level can also switch pid namespace.
> > > To fork() the entire pstree of a container, we need to switch from the pid
> > > namespace of the template container to the  target container's pid
> > > namespace. But it is blocked by the following code:
> > >
> > > ...
> > >         while (ancestor->level > active->level)
> > >                 ancestor = ancestor->parent;
> > >         if (ancestor != active)
> > >                 return -EINVAL;
> > > ...
> > >
> > > Can we give this code permission, such as CAP_SYS_ADMIN ..., so that those
> > > with this permission can switch to sibling pid namespace. Rather than just
> > > parent, parent ...
> > >
> > > Do you think this plan is okay?  Or can you give me some suggestions?
> >
> > I'll defer to Christian on this, but it seems like moving processes
> > sideways is kind of unexpected. I agree it'd need privilege if we did
> > it, though.
> >
> >
>
> I'll defer to Christian on this, but it seems like moving processes
> sideways is kind of unexpected. I agree it'd need privilege if we did
> it, though.
>
> Thanks for your suggestion, my plan is to give this code SYS_ADMIN permissions.
>
> CAP_SYS_ADMIN has been checked in pidns_install(), as follows:
> static int pidns_install(struct nsproxy *nsproxy, struct ns_common *ns)
> {
> ...
> if (!ns_capable(new->user_ns, CAP_SYS_ADMIN) ||
> !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
> return -EPERM;
> ...
> }
>
> So can I delete this code:
> ancestor = new;
> while (ancestor->level > active->level)
> ancestor = ancestor->parent;
> if (ancestor != active)
> return -EINVAL；
>
> Thanks，
> Yunhui

Could you help me look into this issue?