From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752507Ab2DMEkm (ORCPT ); Fri, 13 Apr 2012 00:40:42 -0400 Received: from mail-pb0-f46.google.com ([209.85.160.46]:60414 "EHLO mail-pb0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752098Ab2DMEki (ORCPT ); Fri, 13 Apr 2012 00:40:38 -0400 MIME-Version: 1.0 In-Reply-To: References: <1334267284-19166-1-git-send-email-wad@chromium.org> From: Andy Lutomirski Date: Thu, 12 Apr 2012 21:40:13 -0700 Message-ID: Subject: Re: [PATCH v18 01/15] Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs To: James Morris Cc: Andrew Lutomirski , Will Drewry , linux-kernel@vger.kernel.org, linux-man@vger.kernel.org, linux-security-module@vger.kernel.org, linux-arch@vger.kernel.org, linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com, netdev@vger.kernel.org, x86@kernel.org, arnd@arndb.de, "David S. Miller" , hpa@zytor.com, mingo@redhat.com, Oleg Nesterov , peterz@infradead.org, rdunlap@xenotime.net, mcgrathr@chromium.org, tglx@linutronix.de, Eric Paris , Serge Hallyn , djm@mindrot.org, scarybeasts@gmail.com, indan@nul.nu, pmoore@redhat.com, Andrew Morton , Jonathan Corbet , eric.dumazet@gmail.com, markus@chromium.org, coreyb@linux.vnet.ibm.com, Kees Cook , Stephen Smalley Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Apr 12, 2012 at 9:34 PM, James Morris wrote: > On Thu, 12 Apr 2012, Andrew Lutomirski wrote: > >> > What about dynamic transitions in SELinux ? >> > >> >> What's a dynamic transition? > > The security label can be changed without an exec: > > See selinux_setprocattr(), for "current". Ah. I see nothing wrong with that, for the same reason I see nothing wrong with setuid (the system call) after PR_SET_NO_NEW_PRIVS. The privileges granted by writing to /proc/self/attr/current were already available in the sense that you could have written to current whenever you wanted to. (FWIW, I think that selinux should have made that the only way to change contexts, full stop. And I think that the setuid and setgid bits were mistakes. Water under the bridge...) --Andy From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com MIME-Version: 1.0 In-Reply-To: References: <1334267284-19166-1-git-send-email-wad@chromium.org> From: Andy Lutomirski Date: Thu, 12 Apr 2012 21:40:13 -0700 Message-ID: Content-Type: text/plain; charset=ISO-8859-1 Subject: [kernel-hardening] Re: [PATCH v18 01/15] Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs To: James Morris Cc: Andrew Lutomirski , Will Drewry , linux-kernel@vger.kernel.org, linux-man@vger.kernel.org, linux-security-module@vger.kernel.org, linux-arch@vger.kernel.org, linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com, netdev@vger.kernel.org, x86@kernel.org, arnd@arndb.de, "David S. Miller" , hpa@zytor.com, mingo@redhat.com, Oleg Nesterov , peterz@infradead.org, rdunlap@xenotime.net, mcgrathr@chromium.org, tglx@linutronix.de, Eric Paris , Serge Hallyn , djm@mindrot.org, scarybeasts@gmail.com, indan@nul.nu, pmoore@redhat.com, Andrew Morton , Jonathan Corbet , eric.dumazet@gmail.com, markus@chromium.org, coreyb@linux.vnet.ibm.com, Kees Cook , Stephen Smalley List-ID: On Thu, Apr 12, 2012 at 9:34 PM, James Morris wrote: > On Thu, 12 Apr 2012, Andrew Lutomirski wrote: > >> > What about dynamic transitions in SELinux ? >> > >> >> What's a dynamic transition? > > The security label can be changed without an exec: > > See selinux_setprocattr(), for "current". Ah. I see nothing wrong with that, for the same reason I see nothing wrong with setuid (the system call) after PR_SET_NO_NEW_PRIVS. The privileges granted by writing to /proc/self/attr/current were already available in the sense that you could have written to current whenever you wanted to. (FWIW, I think that selinux should have made that the only way to change contexts, full stop. And I think that the setuid and setgid bits were mistakes. Water under the bridge...) --Andy