Quoting Cedric Le Goater (legoater@xxxxxxx): > > >> 1. cap_sys_admin check is unfortunate. In discussions about Oren's > >> patchset we've agreed that not having that check from the outset forces > >> us to consider security with each new patch and feature, which is a good > >> thing. > > > > Removing CAP_SYS_ADMIN on restore? > > we've kept the capabilities in our patchset but the user tools doing checkpoint > and restart are setcap'ed appropriately to be able to do different things like : > > clone() the namespaces > mount /dev/mqueue > interact with net_ns > etc. Right, that stuff done in userspace requires capabilities. > at restart, the task are restarted through execve() so they loose their > capabilities automatically. > > but I think we could drop the CAP_SYS_ADMIN tests for some namespaces, > uts and ipc are good candidates. I guess network should require some > privilege. Eric and i have talked about that a lot, and so far are continuing to punt on it. There are too many possibilities for subtle exploits so I'm not suggesting changing those now. But checkpoint and restart are entirely new. If at each small step we accept that an unprivileged user should be able to use it safely, that will lead to a better design, i.e. doing may_ptrace before checkpoint, and always doing access checks before re-creating a resource. If we *don't* do that, we'll have a big-stick setuid root checkpoint and restart program which isn't at all trustworthy (bc it hasn't received due scrutiny at each commit point), but must be trusted by anyone wanting to use it. And if we're too afraid to remove CAP_SYS_ADMIN checks from unsharing one innocuous namespace, will we ever convince ourselves to remove it from an established feature that can recreate every type of resource on the system? -serge _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/containers
