Re: [Devel] call_usermodehelper in containers

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Jeff,

On Mon, Nov 11, 2013 at 07:18 -0500, Jeff Layton wrote:
> What's the correct approach to fix this? One possibility would be to
> keep a kernel thread around that sits in the correct namespace(s) and
> has the right privileges, and then use that to launch UMH programs.
> That thread could be spawned whenever someone runs rpc.nfsd inside a
> container.
> 
> Not very elegant, but it seems like something that would work.
> 
> Are there better approaches?

What's the reasoning behind this?  I mean, it is not very obvious what
we should keep here.  Compare 2 cases:

1) root process with all caps spawns new ns, then drops some of caps;

2) root process with all caps drops some of his caps and then spawns new ns.

>From the programmer's POV both cases are valid and lead to absolutely
the same limitations inside of the new namespace.  However, from kernel
POV they differ -- if save cap set when ns is created then in (1) we'll
have cap'ed UMH, in (2) we'll have UMH with only several caps.  It might
significantly influence on ability of UMH to do its job and ability of
this limited ns to escape from the sandbox.

So, what semantic should UMH privileges have?


Also, an orthogonal addition: you might want to keep only minimum
information about capabilities or something -- keep only cap_t field in
namespace structure without explicit kernel thread for each ns.  When UMH is
created, just fill the required caps in it.

Thanks,

-- 
Vasily Kulikov
http://www.openwall.com - bringing security into open computing environments
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]
  Powered by Linux