From: Alejandro Colomar <alx@kernel.org>
To: Richard Weinberger <richard@nod.at>,
serge@hallyn.com, christian@brauner.io, ipedrosa@redhat.com,
gscrivan@redhat.com, andreas.gruenbacher@gmail.com
Cc: acl-devel@nongnu.org, linux-man@vger.kernel.org,
linux-api@vger.kernel.org, linux-fsdevel@vger.kernel.org,
ebiederm@xmission.com
Subject: Re: [PATCH 2/3] user_namespaces.7: Document pitfall with negative permissions and user namespaces
Date: Wed, 30 Aug 2023 11:26:43 +0200 [thread overview]
Message-ID: <be7f7173-0ede-9eca-7b4c-9693743c7189@kernel.org> (raw)
In-Reply-To: <51d4691d-dbc8-2e70-edc8-3b5814213c3f@kernel.org>
[-- Attachment #1.1: Type: text/plain, Size: 3965 bytes --]
Hi,
On 2023-08-29 23:32, Alejandro Colomar wrote:
> Hi Richard,
>
> On 2023-08-29 22:58, Richard Weinberger wrote:
>> It is little known that user namespaces and some helpers
>> can be used to bypass negative permissions.
>>
>> Signed-off-by: Richard Weinberger <richard@nod.at>
>> ---
>> This patch applies to the Linux man-pages project.
>> ---
>> man7/user_namespaces.7 | 29 +++++++++++++++++++++++++++++
>> 1 file changed, 29 insertions(+)
>>
>> diff --git a/man7/user_namespaces.7 b/man7/user_namespaces.7
>> index a65854d737cf..4927e194bcdc 100644
>> --- a/man7/user_namespaces.7
>> +++ b/man7/user_namespaces.7
>> @@ -1067,6 +1067,35 @@ the remaining unsupported filesystems
>> Linux 3.12 added support for the last of the unsupported major filesystems,
>> .\" commit d6970d4b726cea6d7a9bc4120814f95c09571fc3
>> XFS.
>> +.SS Negative permissions and Linux user namespaces
>> +While it is technically feasible to establish negative permissions through
>
> Please use semantic newlines.
>
> $ MANWIDTH=72 man man-pages | sed -n '/Use semantic newlines/,/^$/p'
> Use semantic newlines
> In the source of a manual page, new sentences should be started
> on new lines, long sentences should be split into lines at clause
> breaks (commas, semicolons, colons, and so on), and long clauses
> should be split at phrase boundaries. This convention, sometimes
> known as "semantic newlines", makes it easier to see the effect
> of patches, which often operate at the level of individual sen‐
> tences, clauses, or phrases.
>
>> +DAC or ACL settings, such an approach is widely regarded as a suboptimal
>> +practice. Furthermore, the utilization of Linux user namespaces introduces the
>
> Two spaces after period, if at all. But note that semantic newlines
> preclude that possibility.
I should clarify that this is not a matter of style. Software will
behave incorrectly if you don't double-space after a period.
In shadow, I see that there's only one space after period in all of
the pages. I'll send a patch to fix that.
Cheers,
Alex
>
>> +potential to circumvent specific negative permissions. This issue stems
>> +from the fact that privileged helpers, such as
>> +.BR newuidmap (1) ,
>
> Thas second space is spurious.
>
>> +enable unprivileged users to create user namespaces with subordinate user and
>> +group IDs. As a consequence, users can drop group memberships, resulting
>> +in a situation where negative permissions based on group membership no longer
>> +apply.
>> +
>
> Use .PP instead of blanks.
>
>> +Example:
>> +.in +4n
>> +.EX
>> +$ \fBid\fP
>> +uid=1000(rw) gid=1000(rw) groups=1000(rw),1001(nogames)
>> +$ \fBunshare -S 0 -G 0 --map-users=100000,0,65536 --map-groups=100000,0,65536 id\fP
>> +uid=0(root) gid=0(root) groups=0(root)
>
> This example is not working:
>
> $ echo bar > foo
> $ sudo chmod g= foo
> $ sudo chown man foo
> $ ls -l foo
> -rw----r-- 1 man alx 4 Aug 29 23:28 foo
> $ cat foo
> cat: foo: Permission denied
> $ id
> uid=1000(alx) gid=1000(alx) groups=1000(alx),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),115(lpadmin),118(scanner)
> $ unshare ‐S 0 ‐G 0 ‐‐map‐users=100000,0,65536 ‐‐map‐groups=100000,0,65536 id
> unshare: failed to execute ‐S: No such file or directory
>
>
>> +.EE
>> +.in
>> +
>> +User rw got rid of it's supplementary groups and can now access files that
>> +have been protected using negative permissions that match groups such as \fBnogames\fP.
>> +Please note that the
>> +.BR unshare (1)
>> +tool uses internally
>> +.BR newuidmap (1) .
>> +
>
> Cheers,
> Alex
>
>> .\"
>> .SH EXAMPLES
>> The program below is designed to allow experimenting with
>
--
<http://www.alejandro-colomar.es/>
GPG key fingerprint: A9348594CE31283A826FBDD8D57633D441E25BB5
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
next prev parent reply other threads:[~2023-08-30 18:45 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-29 20:58 [PATCH 0/3] Document impact of user namespaces and negative permissions Richard Weinberger
2023-08-29 20:58 ` [PATCH 1/3] man: Document pitfall with negative permissions and user namespaces Richard Weinberger
2023-08-30 8:19 ` Christian Brauner
2023-08-29 20:58 ` [PATCH 2/3] user_namespaces.7: " Richard Weinberger
2023-08-29 21:32 ` Alejandro Colomar
2023-08-29 21:38 ` Alejandro Colomar
2023-08-29 21:40 ` Richard Weinberger
2023-08-29 21:39 ` Richard Weinberger
2023-08-29 21:40 ` Alejandro Colomar
2023-08-30 9:26 ` Alejandro Colomar [this message]
2023-08-30 8:18 ` Christian Brauner
2023-08-29 20:58 ` [PATCH 3/3] man: " Richard Weinberger
2023-08-30 8:19 ` Christian Brauner
2023-08-29 21:26 ` [PATCH 0/3] Document impact of user namespaces and negative permissions Alejandro Colomar
2023-08-29 21:32 ` Richard Weinberger
2023-09-13 14:35 ` Alejandro Colomar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=be7f7173-0ede-9eca-7b4c-9693743c7189@kernel.org \
--to=alx@kernel.org \
--cc=acl-devel@nongnu.org \
--cc=andreas.gruenbacher@gmail.com \
--cc=christian@brauner.io \
--cc=ebiederm@xmission.com \
--cc=gscrivan@redhat.com \
--cc=ipedrosa@redhat.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-man@vger.kernel.org \
--cc=richard@nod.at \
--cc=serge@hallyn.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).