From: Austin S Hemmelgarn <ahferroin7@gmail.com>
To: Al Viro <viro@ZenIV.linux.org.uk>,
Seth Forshee <seth.forshee@canonical.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>,
linux-bcache@vger.kernel.org, dm-devel@redhat.com,
linux-raid@vger.kernel.org, linux-mtd@lists.infradead.org,
linux-fsdevel@vger.kernel.org,
linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov,
Serge Hallyn <serge.hallyn@canonical.com>,
Andy Lutomirski <luto@amacapital.net>,
linux-kernel@vger.kernel.org, Theodore Ts'o <tytso@mit.edu>
Subject: Re: [PATCH v3 0/7] User namespace mount updates
Date: Wed, 18 Nov 2015 10:34:57 -0500 [thread overview]
Message-ID: <564C9AA1.30509@gmail.com> (raw)
In-Reply-To: <20151118145818.GC22011@ZenIV.linux.org.uk>
[-- Attachment #1: Type: text/plain, Size: 2774 bytes --]
On 2015-11-18 09:58, Al Viro wrote:
> On Wed, Nov 18, 2015 at 08:22:38AM -0600, Seth Forshee wrote:
>
>> But it still requires the admin set it up that way, no? And aren't
>> privileges required to set up those devices in the first place?
>>
>> I'm not saying that it wouldn't be a good idea to lock down the backing
>> stores for those types of devices too, just that it isn't something that
>> a regular user could exploit without an admin doing something to
>> facilitate it.
>
> Sigh... If it boils down to "all admins within all containers must be
> trusted not to try and break out" (along with "roothole in any container
> escalates to kernel-mode code execution on host"), then what the fuck
> is the *point* of bothering with containers, userns, etc. in the first
> place? If your model is basically "you want isolation, just use kvm",
> fine, but where's the place for userns in all that?
In this case, Seth is referring to the host admin, not the container admin.
>
> And if you are talking about the _host_ admin, then WTF not have him just
> mount what's needed as part of setup and to hell with mounting those
> inside the container?
This is decidedly non-trivial to handle in some cases. IIRC, one of the
particular things that sparked this in the first place was the Chrome
Native Client having to have CAP_SYS_ADMIN or SUID set on it to handle
setting up it's own sandbox, which is not something that should ever be
set on an executable that runs untrusted code (which is the whole point
of NaCl).
>
> Look at that from the hosting company POV - they are offering a bunch of
> virtual machines on one physical system. And you want the admins on those
> virtual machines independent from the host admin. Fine, but then you
> really need to keep them unable to screw each other or gain kernel-mode
> execution on the host.
>
> Again, what's the point of all that? I assumed the model where containers
> do, you know, contain what's in them, regardless of trust. You guys seem
> to assume something different and I really wonder what it _is_...
Yes, hosting and isolation of untrusted code are valid uses for
containers, which is why I suggested the ability to disallow mounts
other than FUSE, and make that the default state. There are other
perfectly valid uses for them as well, and for me the two I'm
particularly interested in are safe deployment of a new system from an
existing system (ala Gentoo or Arch installation, or manual installation
of *BSD), and running non-native distros without virtualization (On a
single user system, virtualization is overkill when all you want is a
Debian or Fedora or Arch testing environment and don't care about their
specific kernel features).
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 3019 bytes --]
next prev parent reply other threads:[~2015-11-18 15:34 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-17 16:39 [PATCH v3 0/7] User namespace mount updates Seth Forshee
2015-11-17 16:39 ` [PATCH v3 1/7] block_dev: Support checking inode permissions in lookup_bdev() Seth Forshee
2015-11-17 16:39 ` [PATCH v3 2/7] block_dev: Check permissions towards block device inode when mounting Seth Forshee
2015-11-17 16:39 ` [PATCH v3 3/7] mtd: Check permissions towards mtd " Seth Forshee
2015-11-17 16:39 ` [PATCH v3 4/7] fs: Treat foreign mounts as nosuid Seth Forshee
2015-11-18 0:00 ` James Morris
2015-11-17 16:39 ` [PATCH v3 5/7] selinux: Add support for unprivileged mounts from user namespaces Seth Forshee
2015-11-18 0:02 ` James Morris
2015-11-17 16:39 ` [PATCH v3 6/7] userns: Replace in_userns with current_in_userns Seth Forshee
2015-11-18 0:03 ` James Morris
2015-11-17 16:39 ` [PATCH v3 7/7] Smack: Handle labels consistently in untrusted mounts Seth Forshee
2015-11-17 18:24 ` Casey Schaufler
2015-11-17 18:24 ` Casey Schaufler
2015-11-18 0:12 ` James Morris
2015-11-18 0:50 ` Seth Forshee
2015-11-17 17:05 ` [PATCH v3 0/7] User namespace mount updates Al Viro
2015-11-17 17:25 ` Seth Forshee
2015-11-17 17:45 ` Serge E. Hallyn
2015-11-17 17:55 ` Al Viro
2015-11-17 18:34 ` Seth Forshee
2015-11-17 19:12 ` Richard Weinberger
2015-11-17 19:21 ` Seth Forshee
2015-11-17 19:25 ` Octavian Purdila
2015-11-17 20:12 ` Richard Weinberger
2015-11-17 22:00 ` Octavian Purdila
2015-11-19 15:23 ` Seth Forshee
2015-11-19 16:19 ` Octavian Purdila
2015-11-19 16:31 ` Seth Forshee
2015-11-20 17:33 ` Serge E. Hallyn
2015-11-17 19:26 ` Richard Weinberger
2015-11-18 19:10 ` Theodore Ts'o
2015-11-18 19:28 ` Seth Forshee
2015-11-18 19:32 ` Serge Hallyn
2015-11-17 19:02 ` Austin S Hemmelgarn
2015-11-17 19:16 ` Seth Forshee
2015-11-17 19:16 ` Seth Forshee
2015-11-17 20:54 ` Austin S Hemmelgarn
2015-11-17 21:32 ` Seth Forshee
2015-11-18 12:23 ` Austin S Hemmelgarn
2015-11-18 14:22 ` Seth Forshee
2015-11-18 14:58 ` Al Viro
2015-11-18 15:05 ` Seth Forshee
2015-11-18 15:05 ` Seth Forshee
2015-11-18 15:13 ` Al Viro
2015-11-18 15:19 ` Richard Weinberger
2015-11-19 7:47 ` James Morris
2015-11-19 7:53 ` Richard Weinberger
2015-11-19 14:21 ` Serge E. Hallyn
2015-11-19 15:04 ` Richard Weinberger
2015-11-19 14:37 ` Colin Walters
2015-11-19 14:49 ` Richard Weinberger
2015-11-19 15:17 ` Richard W.M. Jones
2015-11-19 14:58 ` Serge E. Hallyn
2015-11-18 15:34 ` Austin S Hemmelgarn [this message]
2015-11-18 15:36 ` Nikolay Borisov
2015-11-17 19:30 ` Al Viro
2015-11-17 20:39 ` Austin S Hemmelgarn
2015-11-17 21:05 ` Al Viro
2015-11-17 22:01 ` Seth Forshee
2015-11-18 12:46 ` Austin S Hemmelgarn
2015-11-18 14:30 ` Seth Forshee
2015-11-18 15:38 ` Austin S Hemmelgarn
[not found] ` <564C9B92.5080107-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2015-11-18 18:33 ` Daniel J Walsh
2015-11-18 18:33 ` Daniel J Walsh
2015-11-18 18:33 ` Daniel J Walsh
2015-11-18 18:44 ` J. Bruce Fields
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=564C9AA1.30509@gmail.com \
--to=ahferroin7@gmail.com \
--cc=dm-devel@redhat.com \
--cc=ebiederm@xmission.com \
--cc=linux-bcache@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
--cc=linux-raid@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=selinux@tycho.nsa.gov \
--cc=serge.hallyn@canonical.com \
--cc=seth.forshee@canonical.com \
--cc=tytso@mit.edu \
--cc=viro@ZenIV.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.