Hi Jeff, On Mon, Nov 11, 2013 at 07:18 -0500, Jeff Layton wrote: > What's the correct approach to fix this? One possibility would be to > keep a kernel thread around that sits in the correct namespace(s) and > has the right privileges, and then use that to launch UMH programs. > That thread could be spawned whenever someone runs rpc.nfsd inside a > container. > > Not very elegant, but it seems like something that would work. > > Are there better approaches? What's the reasoning behind this? I mean, it is not very obvious what we should keep here. Compare 2 cases: 1) root process with all caps spawns new ns, then drops some of caps; 2) root process with all caps drops some of his caps and then spawns new ns. >From the programmer's POV both cases are valid and lead to absolutely the same limitations inside of the new namespace. However, from kernel POV they differ -- if save cap set when ns is created then in (1) we'll have cap'ed UMH, in (2) we'll have UMH with only several caps. It might significantly influence on ability of UMH to do its job and ability of this limited ns to escape from the sandbox. So, what semantic should UMH privileges have? Also, an orthogonal addition: you might want to keep only minimum information about capabilities or something -- keep only cap_t field in namespace structure without explicit kernel thread for each ns. When UMH is created, just fill the required caps in it. Thanks, -- Vasily Kulikov http://www.openwall.com - bringing security into open computing environments -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
