linux-kernel - Re: [PATCH 1/3] capabilities: user namespace capabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 17 May 2024 11:02:23 -0700
From: Jonathan Calmels <jcalmels@...0.net>
To: "Eric W. Biederman" <ebiederm@...ssion.com>
Cc: brauner@...nel.org, Luis Chamberlain <mcgrof@...nel.org>, 
	Kees Cook <keescook@...omium.org>, Joel Granados <j.granados@...sung.com>, 
	Serge Hallyn <serge@...lyn.com>, Paul Moore <paul@...l-moore.com>, 
	James Morris <jmorris@...ei.org>, David Howells <dhowells@...hat.com>, 
	Jarkko Sakkinen <jarkko@...nel.org>, containers@...ts.linux.dev, linux-kernel@...r.kernel.org, 
	linux-fsdevel@...r.kernel.org, linux-security-module@...r.kernel.org, keyrings@...r.kernel.org
Subject: Re: [PATCH 1/3] capabilities: user namespace capabilities

> > On Fri, May 17, 2024 at 06:32:46AM GMT, Eric W. Biederman wrote:
> As I read your introduction you were justifying the introduction
> of a new security mechanism with the observation that distributions
> were carrying distribution specific patches.
> 
> To the best of my knowledge distribution specific patches and
> distributions disabling user namespaces have been gone for quite a
> while.  So if that has changed recently I would like to know.

On the top of my head:

- RHEL based:
  namespace.unpriv_enable
  user_namespace.enable

- Arch/Debian based:
  kernel.unprivileged_userns_clone

- Ubuntu based:
  kernel.apparmor_restrict_unprivileged_userns

I'm not sure which exact version those apply to, but it's definitely
still out there.

The observation is that while you can disable namespaces today, in
practice it breaks userspace in various ways. Hence, being able to
control capabilities is a better way to approach it.

For example, today's big hammer to prevent CAP_NET_ADMIN in userns:

# sysctl -qw user.max_net_namespaces=0

$ unshare -U -r -n ip tuntap add mode tap tap0 && echo OK
unshare: unshare failed: No space left on device

With patch, this becomes manageable:

# capsh --drop=cap_net_admin --secbits=$((1 << 8)) --user=$USER -- \
        -c 'unshare -U -r -n ip tuntap add mode tap tap0 && echo OK'
ioctl(TUNSETIFF): Operation not permitted