lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 13 Dec 2009 08:44:25 -0500 From: Michael Stone <michael@...top.org> To: Rémi Denis-Courmont <remi@...lab.net> Cc: Michael Stone <michael@...top.org>, linux-kernel@...r.kernel.org, netdev@...r.kernel.org, linux-security-module@...r.kernel.org, Andi Kleen <andi@...stfloor.org>, David Lang <david@...g.hm>, Oliver Hartkopp <socketcan@...tkopp.net>, Alan Cox <alan@...rguk.ukuu.org.uk>, Herbert Xu <herbert@...dor.apana.org.au>, Valdis Kletnieks <Valdis.Kletnieks@...edu>, Bryan Donlan <bdonlan@...il.com>, Evgeniy Polyakov <zbr@...emap.net>, "C. Scott Ananian" <cscott@...ott.net>, James Morris <jmorris@...ei.org>, "Eric W. Biederman" <ebiederm@...ssion.com>, Bernie Innocenti <bernie@...ewiz.org>, Mark Seaborn <mrs@...hic-beasts.com> Subject: Re: Network isolation with RLIMIT_NETWORK, cont'd. Rémi, > You explicitly mention the need to connect to the X server over local sockets. > But won't that allow the sandboxed application to send synthetic events to any > other X11 applications? X11 cookie authentication and socket ownership+permissions effectively control access to the X server by local processes. Thus, as an isolation author, I may easily grant my isolated process any of: a) full access to the main X server b) some access to a nested X server (like a Xephyr) which I'm using to do some event filtering c) no access to any X server by witholding thec cookies or by changing the permissions on the X socket to be more restrictive with existing techniques. > Hence unless the whole X server has restricted network access, this seems a > bit broken? Not broken for the reasons I mentioned above. However, using this rlimit to disable fresh network access for the whole X server actually sounds like a rather nice idea; thanks for suggesting it. > D-Bus, which also uses local sockets, will exhibit similar issues, Absolutely. However, D-Bus, like X, already has strong authentication mechanisms in place that permit me to use pre-existing Unix discretionary access control to limit what communication takes place. More specifically, I can a) tell D-Bus to use a file-system socket and change the credentials on that socket b) use cookies to authenticate incoming connections c) explicitly tell D-Bus what users and groups may connect via configuration files d) explicitly tell D-Bus what users and groups may send and receive which messages via configuration files > as will any unrestricted IPC mechanism in fact. I am not sure if restricting > network access but not other file descriptors makes that much sense...? Then > again, I'm not entirely clear what you are trying to solve. Inadequately access-controlled IPC mechanisms are the specific problem that I am trying to address. Fortunately, these mechanisms seem to be rare: the only two that I know of are non-AF_UNIX sockets and ptrace(). All the other IPC mechanisms that I have seen may be adequately restricted by changing file permissions and ownership. > If I had to sandbox something, I'd drop the process file limit to 0. That is a technique that is commonly used by many people in this space. It works well for some limited use cases and, like SECCOMP, is too restrictive for the kinds of general-purpose applications that I'm sandboxing. If you're interested, http://cr.yp.to/unix/disablenetwork.html lists several specific problems. To see more, just try dropping RLIMIT_NOFILE to 0 before launching all your favorite apps. I'd be curious to hear how far you get. Regards, Michael -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists