On Tue, Apr 26, 2016 at 03:39:54PM -0700, Kees Cook wrote: > On Tue, Apr 26, 2016 at 3:26 PM, Serge E. Hallyn <serge@xxxxxxxxxx> wrote: > > Quoting Kees Cook (keescook@xxxxxxxxxxxx): > >> On Fri, Apr 22, 2016 at 10:26 AM, <serge.hallyn@xxxxxxxxxx> wrote: > >> > From: Serge Hallyn <serge.hallyn@xxxxxxxxxx> ... > >> This looks like userspace must knowingly be aware that it is in a > >> namespace and to DTRT instead of it being translated by the kernel > >> when setxattr is called under !init_user_ns? > > > > Yes - my libcap2 patch checks /proc/self/uid_map to decide that. If that > > shows you are in init_user_ns then it uses security.capability, otherwise > > it uses security.nscapability. > > > > I've occasionally considered having the xattr code do the quiet > > substitution if need be. > > > > In fact, much of this structure comes from when I was still trying to > > do multiple values per xattr. Given what we're doing here, we could > > keep the xattr contents exactly the same, just changing the name. > > So userspace could just get and set security.capability; if you are > > in a non-init user_ns, if security.capability is set then you cannot > > set it; if security.capability is not set, then the kernel writes > > security.nscapability instead and returns success. > > > > I don't like magic, but this might be just straightforward enough > > to not be offensive. Thoughts? > > Yeah, I think it might be better to have the magic in this case, since > it seems weird to just reject setxattr if a tool didn't realize it was > in a namespace. I'm not sure -- it is also nice to have an explicit > API here. > > I would defer to Eric or Michael on that. I keep going back and forth, > though I suspect it's probably best to do what you already have > (explicit API). Michael, Eric, what do you think? The choice we're making here is whether we should 1. Keep a nice simple separate pair of xattrs, the pre-existing security.capability which can only be written from init_user_ns, and the new (in this patch) security.nscapability which you can write to any file where you are privileged wrt the file. 2. Make security.capability somewhat 'magic' - if someone in a non-initial user ns tries to write it and has privilege wrt the file, then the kernel silently writes security.nscapability instead. The biggest drawback of (1) would be any tar-like program trying to restore a file which had security.capability, needing to know to detect its userns and write the security.nscapability instead. The drawback of (2) is ~\o/~ magic. -serge -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
