Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Jan 25, 2016 at 10:51 AM, Kees Cook <keescook@xxxxxxxxxxxx> wrote:
> On Sun, Jan 24, 2016 at 2:22 PM, Andy Lutomirski <luto@xxxxxxxxxxxxxx> wrote:
>> On Fri, Jan 22, 2016 at 7:02 PM, Eric W. Biederman
>> <ebiederm@xxxxxxxxxxxx> wrote:
>>> Kees Cook <keescook@xxxxxxxxxxxx> writes:
>>>
>>>> There continues to be unexpected side-effects and security exposures
>>>> via CLONE_NEWUSER. For many end-users running distro kernels with
>>>> CONFIG_USER_NS enabled, there is no way to disable this feature when
>>>> desired. As such, this creates a sysctl to restrict CLONE_NEWUSER so
>>>> admins not running containers or Chrome can avoid the risks of this
>>>> feature.
>>>
>>> I don't actually think there do continue to be unexpected side-effects
>>> and security exposures with CLONE_NEWUSER.  It takes a while for all of
>>> the fixes to trickle out to distros.  At most what I have seen recently
>>> are problems with other kernel interfaces being amplified with user
>>> namespaces.  AKA the current mess with devpts, and the unexpected
>>> issues with bind mounts in mount namespaces.
>>>
>>
>>>
>>> So to keep this productive.  Please tell me about the threat model
>>> you envision, and how you envision knobs in the kernel being used to
>>> counter those threats.
>>
>> I consider the ability to use CLONE_NEWUSER to acquire CAP_NET_ADMIN
>> over /any/ network namespace and to thus access the network
>> configuration API to be a huge risk.  For example, unprivileged users
>> can program iptables.  I'll eat my hat if there are no privilege
>> escalations in there.  (They can't request module loading, but still.)
>
> Should I consider this an Ack for the patch? :)

Only if you explain why you need the CAP_SYS_ADMIN check.  :)

IOW, I think you could change that one line of code and have a less
weird version of the patch that would work just fine.

--Andy


-- 
Andy Lutomirski
AMA Capital Management, LLC
--
To unsubscribe from this list: send the line "unsubscribe linux-doc" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Linux FS]     [Yosemite Forum]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]     [Linux Resources]

  Powered by Linux