On Thu, May 01, 2014 at 04:57:13PM -0700, Andy Lutomirski wrote: > Suppose I bind-mount /usr into a private namespace with > nosuid,nodev,ro. How can you use it to attack anything? The only > thing I've thought of is to open fifos and connect to sockets. I'm > assuming that there's a pid namespace blocking ptrace and such and a > network namespace blocking abstract sockets. How many FIFOs and sockets are there in your /usr? Here all I see outside of /dev, /run and /tmp (across seven boxen; I can check more, but I really doubt it'll catch anything) is the grand total of 4: /lib/cryptsetup/passfifo /var/lib/oprofile/opd_pipe /var/lib/nfs/rpc_pipefs/nfs/clnt0/idmap /var/lib/nfs/rpc_pipefs/gssd/clntXX/gssd None of those in /usr and I don't believe that you seriously propose to bind e.g. /lib/cryptsetup into your sandbox. And while we are at it, exposing host /usr is *not* a good idea - if nothing else, it gives quite a bit of information about the versions of software installed on the host. Ability to watch atime of /usr/bin/* also might be interesting, etc. Do you, by any chance, plan to expose the host /tmp or /run? Or rpc_pipefs, for that matter... -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
