On Fri, Apr 6, 2012 at 14:15, Andrew Lutomirski <luto@xxxxxxx> wrote: > Agreed, but I'm talking about something totally different: if I can > use CLONE_NEWPID, then I can send an unexpected pid with SCM_CREDS. > The SCM_CREDS receive code should remap pids. Yes, I know. It's broken. And so is the view of the /proc filesystem when inside a pid namespace. And things behave funny if you don't set up a new "init" process inside of the pid namespace. And I am sure, a few other things are broken that we just haven't run into. CLONE_NEWPID is tricky. I can understand, if you want to fix it first. Looking forward to seeing some patches in the future; please cc me, if you want feedback from an actual user of this code. The SCM_CREDS issue is the most serious one of the above, but it doesn't bother me personally, as I would just set up my sandbox policy to disallow all of SCM_CREDS (*). But that obviously not a good excuse for leaving a kernel bug around. Overall, I like both NO_NEW_PRIVS and BPF filters for seccomp though; they are a great way to reduce the attack surface of the kernel. Kernel bugs become a lot less of a headache, if I have a way to filter out the buggy parts of the kernel. It isn't a panacea, but it's a great new tool to harden applications. Markus *) this is currently difficult to filter SCM_CREDS, if we still want to allow SCM_RIGHTS. See my earlier complaint about sendmsg(). Currently, filtering of sendmsg() probably requires the use of a helper process. -- To unsubscribe from this list: send the line "unsubscribe linux-arch" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
