On Wed, May 18, 2022 at 09:56:26PM -0700, Andrii Nakryiko wrote: > On Wed, May 18, 2022 at 4:26 AM Miklos Szeredi <miklos@xxxxxxxxxx> wrote: > > > > On Wed, 18 May 2022 at 13:22, Christian Brauner <brauner@xxxxxxxxxx> wrote: > > > > > > On Tue, May 17, 2022 at 12:50:32PM -0400, Dave Marchevsky wrote: > > > > > > Sorry to ressurect this old thread. My proposed alternate approach of "special > > > > ioctl to grant exception to descendant userns check" proved unnecessarily > > > > complex: ioctls also go through fuse_allow_current_process check, so a special > > > > carve-out would be necessary for in both ioctl and fuse_permission check in > > > > order to make it possible for non-descendant-userns user to opt in to exception. > > > > > > > > How about a version of this patch with CAP_DAC_READ_SEARCH check? This way > > > > there's more of a clear opt-in vs CAP_SYS_ADMIN. > > > > > > I still think this isn't needed given that especially for the use-cases > > > listed here you have a workable userspace solution to this problem. > > Unfortunately such userspace solution isn't that great in practice. > It's both very cumbersome to implement and integrate into existing > profiling solutions and causes undesired inefficiencies when > processing (typically for stack trace symbolization) lots of profiled > processes. > > > > > > > If the CAP_SYS_ADMIN/CAP_DAC_READ_SEARCH check were really just about > > > giving a privileged task access then it'd be fine imho. But given that > > > this means the privileged task is open to a DoS attack it seems we're > > > building a trap into the fuse code. > > Running under root presumably means that the application knows what > it's doing (and it can do a lot of dangerous and harmful things > outside of FUSE already), so why should there be any more opt in for > it to access file contents? CAP_SYS_ADMIN can do pretty much anything > in the system, it seems a bit asymmetric to have extra FUSE-specific > restrictions for it. Processes trying to access a fuse filesystem that is not in the same userns or a descendant userns are open to DoS attacks. This specifically includes processes capable in the initial userns. If it suddenly becomes possible that an initial userns capable process can access fuse filesystems in any userns than any such process accessing a fuse filesystem unintentionally will be susceptible to DoS attacks. Iow, the problem isn't that an initial userns capable process is doing something harmful and we're overly careful trying to prevent this and thereby going against standard CAP_SYS_ADMIN assumptions; it's that an initial userns capable process can unintentionally have something harmful done to it simply by accessing a fuse filesystem. This is even more concerning since rn this isn't possible so this patch is removing a protection/security mechanism. The performance argument isn't enough to justify this imho.
