From: Kees Cook <keescook@chromium.org> To: Andrew Morton <akpm@linux-foundation.org> Cc: "Kees Cook" <keescook@chromium.org>, "Al Viro" <viro@zeniv.linux.org.uk>, "Richard Weinberger" <richard@nod.at>, "Eric W. Biederman" <ebiederm@xmission.com>, "Andy Lutomirski" <luto@amacapital.net>, "Robert Święcki" <robert@swiecki.net>, "Dmitry Vyukov" <dvyukov@google.com>, "David Howells" <dhowells@redhat.com>, "Miklos Szeredi" <mszeredi@suse.cz>, "Kostya Serebryany" <kcc@google.com>, "Alexander Potapenko" <glider@google.com>, "Eric Dumazet" <edumazet@google.com>, "Sasha Levin" <sasha.levin@oracle.com>, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: [PATCH 2/2] sysctl: allow CLONE_NEWUSER to be disabled Date: Fri, 22 Jan 2016 14:39:05 -0800 [thread overview] Message-ID: <1453502345-30416-3-git-send-email-keescook@chromium.org> (raw) In-Reply-To: <1453502345-30416-1-git-send-email-keescook@chromium.org> There continues to be many CONFIG_USER_NS related security exposures. For admins running distro kernels with CONFIG_USER_NS, there is no way to disable CLONE_NEWUSER. As many systems do not need CLONE_NEWUSER, this provides a way for sysadmins to disable the feature. This is inspired by a similar restriction in Grsecurity, but adds a sysctl. Signed-off-by: Kees Cook <keescook@chromium.org> --- Documentation/sysctl/kernel.txt | 17 +++++++++++++++++ kernel/sysctl.c | 14 ++++++++++++++ kernel/user_namespace.c | 7 +++++++ 3 files changed, 38 insertions(+) diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt index bbfc5e339a3d..e9e8a4f949f5 100644 --- a/Documentation/sysctl/kernel.txt +++ b/Documentation/sysctl/kernel.txt @@ -85,6 +85,7 @@ show up in /proc/sys/kernel: - tainted - threads-max - unknown_nmi_panic +- userns_restrict - watchdog - watchdog_thresh - version @@ -933,6 +934,22 @@ example. If a system hangs up, try pressing the NMI switch. ============================================================== +userns_restrict: + +This toggle indicates whether CLONE_NEWUSER is available. As CLONE_NEWUSER +has many unexpected side-effects and security exposures, this allows the +sysadmin to disable the feature without needing to rebuild the kernel. + +When userns_restrict is set to (0), the default, there are no restrictions. + +When userns_restrict is set to (1), CLONE_NEWUSER is only available to +processes that have CAP_SYS_ADMIN, CAP_SETUID, and CAP_SETGID. + +When userns_restrict is set to (2), CLONE_NEWUSER is not available at all, +and the value is locked to "2" for the duration of the boot. + +============================================================== + watchdog: This parameter can be used to disable or enable the soft lockup detector diff --git a/kernel/sysctl.c b/kernel/sysctl.c index fc8899dd636d..ceb8b107fe28 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -112,6 +112,9 @@ extern int sysctl_nr_open_min, sysctl_nr_open_max; #ifndef CONFIG_MMU extern int sysctl_nr_trim_pages; #endif +#ifdef CONFIG_USER_NS +extern int sysctl_userns_restrict; +#endif /* Constants used for minimum and maximum */ #ifdef CONFIG_LOCKUP_DETECTOR @@ -812,6 +815,17 @@ static struct ctl_table kern_table[] = { .extra2 = &two, }, #endif +#ifdef CONFIG_USER_NS + { + .procname = "userns_restrict", + .data = &sysctl_userns_restrict, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax_cap_sysadmin, + .extra1 = &zero, + .extra2 = &two, + }, +#endif { .procname = "ngroups_max", .data = &ngroups_max, diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index 9bafc211930c..38395f9625ff 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -25,6 +25,7 @@ static struct kmem_cache *user_ns_cachep __read_mostly; static DEFINE_MUTEX(userns_state_mutex); +int sysctl_userns_restrict __read_mostly; static bool new_idmap_permitted(const struct file *file, struct user_namespace *ns, int cap_setid, @@ -84,6 +85,12 @@ int create_user_ns(struct cred *new) !kgid_has_mapping(parent_ns, group)) return -EPERM; + if (sysctl_userns_restrict == 2 || + (sysctl_userns_restrict == 1 && (!capable(CAP_SYS_ADMIN) || + !capable(CAP_SETUID) || + !capable(CAP_SETGID)))) + return -EPERM; + ns = kmem_cache_zalloc(user_ns_cachep, GFP_KERNEL); if (!ns) return -ENOMEM; -- 2.6.3
WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <keescook@chromium.org> To: Andrew Morton <akpm@linux-foundation.org> Cc: "Kees Cook" <keescook@chromium.org>, "Al Viro" <viro@zeniv.linux.org.uk>, "Richard Weinberger" <richard@nod.at>, "Eric W. Biederman" <ebiederm@xmission.com>, "Andy Lutomirski" <luto@amacapital.net>, "Robert Święcki" <robert@swiecki.net>, "Dmitry Vyukov" <dvyukov@google.com>, "David Howells" <dhowells@redhat.com>, "Miklos Szeredi" <mszeredi@suse.cz>, "Kostya Serebryany" <kcc@google.com>, "Alexander Potapenko" <glider@google.com>, "Eric Dumazet" <edumazet@google.com>, "Sasha Levin" <sasha.levin@oracle.com>, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: [kernel-hardening] [PATCH 2/2] sysctl: allow CLONE_NEWUSER to be disabled Date: Fri, 22 Jan 2016 14:39:05 -0800 [thread overview] Message-ID: <1453502345-30416-3-git-send-email-keescook@chromium.org> (raw) In-Reply-To: <1453502345-30416-1-git-send-email-keescook@chromium.org> There continues to be many CONFIG_USER_NS related security exposures. For admins running distro kernels with CONFIG_USER_NS, there is no way to disable CLONE_NEWUSER. As many systems do not need CLONE_NEWUSER, this provides a way for sysadmins to disable the feature. This is inspired by a similar restriction in Grsecurity, but adds a sysctl. Signed-off-by: Kees Cook <keescook@chromium.org> --- Documentation/sysctl/kernel.txt | 17 +++++++++++++++++ kernel/sysctl.c | 14 ++++++++++++++ kernel/user_namespace.c | 7 +++++++ 3 files changed, 38 insertions(+) diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt index bbfc5e339a3d..e9e8a4f949f5 100644 --- a/Documentation/sysctl/kernel.txt +++ b/Documentation/sysctl/kernel.txt @@ -85,6 +85,7 @@ show up in /proc/sys/kernel: - tainted - threads-max - unknown_nmi_panic +- userns_restrict - watchdog - watchdog_thresh - version @@ -933,6 +934,22 @@ example. If a system hangs up, try pressing the NMI switch. ============================================================== +userns_restrict: + +This toggle indicates whether CLONE_NEWUSER is available. As CLONE_NEWUSER +has many unexpected side-effects and security exposures, this allows the +sysadmin to disable the feature without needing to rebuild the kernel. + +When userns_restrict is set to (0), the default, there are no restrictions. + +When userns_restrict is set to (1), CLONE_NEWUSER is only available to +processes that have CAP_SYS_ADMIN, CAP_SETUID, and CAP_SETGID. + +When userns_restrict is set to (2), CLONE_NEWUSER is not available at all, +and the value is locked to "2" for the duration of the boot. + +============================================================== + watchdog: This parameter can be used to disable or enable the soft lockup detector diff --git a/kernel/sysctl.c b/kernel/sysctl.c index fc8899dd636d..ceb8b107fe28 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -112,6 +112,9 @@ extern int sysctl_nr_open_min, sysctl_nr_open_max; #ifndef CONFIG_MMU extern int sysctl_nr_trim_pages; #endif +#ifdef CONFIG_USER_NS +extern int sysctl_userns_restrict; +#endif /* Constants used for minimum and maximum */ #ifdef CONFIG_LOCKUP_DETECTOR @@ -812,6 +815,17 @@ static struct ctl_table kern_table[] = { .extra2 = &two, }, #endif +#ifdef CONFIG_USER_NS + { + .procname = "userns_restrict", + .data = &sysctl_userns_restrict, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax_cap_sysadmin, + .extra1 = &zero, + .extra2 = &two, + }, +#endif { .procname = "ngroups_max", .data = &ngroups_max, diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index 9bafc211930c..38395f9625ff 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -25,6 +25,7 @@ static struct kmem_cache *user_ns_cachep __read_mostly; static DEFINE_MUTEX(userns_state_mutex); +int sysctl_userns_restrict __read_mostly; static bool new_idmap_permitted(const struct file *file, struct user_namespace *ns, int cap_setid, @@ -84,6 +85,12 @@ int create_user_ns(struct cred *new) !kgid_has_mapping(parent_ns, group)) return -EPERM; + if (sysctl_userns_restrict == 2 || + (sysctl_userns_restrict == 1 && (!capable(CAP_SYS_ADMIN) || + !capable(CAP_SETUID) || + !capable(CAP_SETGID)))) + return -EPERM; + ns = kmem_cache_zalloc(user_ns_cachep, GFP_KERNEL); if (!ns) return -ENOMEM; -- 2.6.3
next prev parent reply other threads:[~2016-01-22 22:39 UTC|newest] Thread overview: 80+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-01-22 22:39 [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Kees Cook 2016-01-22 22:39 ` [kernel-hardening] " Kees Cook 2016-01-22 22:39 ` [PATCH 1/2] sysctl: expand use of proc_dointvec_minmax_sysadmin Kees Cook 2016-01-22 22:39 ` [kernel-hardening] " Kees Cook 2016-01-23 3:10 ` Eric W. Biederman 2016-01-23 3:10 ` [kernel-hardening] " Eric W. Biederman 2016-01-23 22:25 ` Jann Horn 2016-01-24 1:20 ` Eric W. Biederman 2016-01-24 1:43 ` Al Viro 2016-01-24 1:56 ` Jann Horn 2016-01-24 6:02 ` Eric W. Biederman 2016-01-24 6:32 ` Jann Horn 2016-01-24 6:44 ` Eric W. Biederman 2016-01-22 22:39 ` Kees Cook [this message] 2016-01-22 22:39 ` [kernel-hardening] [PATCH 2/2] sysctl: allow CLONE_NEWUSER to be disabled Kees Cook 2016-01-22 22:47 ` Robert Święcki 2016-01-22 22:47 ` [kernel-hardening] " Robert Święcki 2016-01-22 22:50 ` Kees Cook 2016-01-22 22:50 ` [kernel-hardening] " Kees Cook 2016-01-22 22:55 ` Robert Święcki 2016-01-22 22:55 ` [kernel-hardening] " Robert Święcki 2016-01-22 23:00 ` Kees Cook 2016-01-22 23:00 ` [kernel-hardening] " Kees Cook 2016-01-23 0:44 ` Serge Hallyn 2016-01-23 0:44 ` [kernel-hardening] " Serge Hallyn 2016-01-23 0:44 ` Serge Hallyn 2016-01-23 0:44 ` [kernel-hardening] " Serge Hallyn 2016-01-23 0:59 ` Ben Hutchings 2016-01-24 20:59 ` Kees Cook 2016-01-24 20:59 ` Kees Cook 2016-01-24 22:20 ` Andy Lutomirski 2016-01-25 18:51 ` Kees Cook 2016-01-22 22:49 ` [PATCH 0/2] " Richard Weinberger 2016-01-22 22:49 ` [kernel-hardening] " Richard Weinberger 2016-01-23 3:02 ` Eric W. Biederman 2016-01-23 3:02 ` [kernel-hardening] " Eric W. Biederman 2016-01-24 20:57 ` Kees Cook 2016-01-24 20:57 ` [kernel-hardening] " Kees Cook 2016-01-26 7:38 ` Serge Hallyn 2016-01-24 22:22 ` Andy Lutomirski 2016-01-24 22:22 ` [kernel-hardening] " Andy Lutomirski 2016-01-25 18:51 ` Kees Cook 2016-01-25 18:51 ` [kernel-hardening] " Kees Cook 2016-01-25 18:53 ` Andy Lutomirski 2016-01-25 18:53 ` [kernel-hardening] " Andy Lutomirski 2016-01-25 18:56 ` Kees Cook 2016-01-25 18:56 ` [kernel-hardening] " Kees Cook 2016-01-25 19:33 ` Eric W. Biederman 2016-01-25 19:33 ` [kernel-hardening] " Eric W. Biederman 2016-01-25 22:34 ` Kees Cook 2016-01-25 22:34 ` [kernel-hardening] " Kees Cook 2016-01-25 23:33 ` Andy Lutomirski 2016-01-25 23:33 ` [kernel-hardening] " Andy Lutomirski 2016-01-26 2:27 ` Daniel Micay 2016-01-26 4:57 ` Eric W. Biederman 2016-01-26 4:57 ` [kernel-hardening] " Eric W. Biederman 2016-01-26 14:38 ` Josh Boyer 2016-01-26 14:38 ` [kernel-hardening] " Josh Boyer 2016-01-26 14:46 ` Austin S. Hemmelgarn 2016-01-26 14:46 ` [kernel-hardening] " Austin S. Hemmelgarn 2016-01-26 14:56 ` Josh Boyer 2016-01-26 14:56 ` [kernel-hardening] " Josh Boyer 2016-01-26 17:20 ` Serge Hallyn 2016-01-26 19:56 ` Josh Boyer 2016-01-26 20:11 ` Austin S. Hemmelgarn 2016-01-26 17:15 ` Serge Hallyn 2016-01-26 18:09 ` Austin S. Hemmelgarn 2016-01-26 18:27 ` Andy Lutomirski 2016-01-26 18:45 ` Austin S. Hemmelgarn 2016-01-26 23:15 ` Kees Cook 2016-01-26 23:13 ` Kees Cook 2016-01-27 10:27 ` Eric W. Biederman 2016-01-27 12:32 ` Austin S. Hemmelgarn 2016-01-28 14:41 ` Robert Święcki 2016-01-28 14:41 ` Robert Święcki 2016-01-26 23:47 ` Josh Boyer 2016-01-26 16:37 ` Kees Cook 2016-01-26 16:37 ` [kernel-hardening] " Kees Cook 2016-01-28 8:56 ` Serge E. Hallyn 2016-01-28 12:53 ` Austin S. Hemmelgarn
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1453502345-30416-3-git-send-email-keescook@chromium.org \ --to=keescook@chromium.org \ --cc=akpm@linux-foundation.org \ --cc=dhowells@redhat.com \ --cc=dvyukov@google.com \ --cc=ebiederm@xmission.com \ --cc=edumazet@google.com \ --cc=glider@google.com \ --cc=kcc@google.com \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-doc@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=luto@amacapital.net \ --cc=mszeredi@suse.cz \ --cc=richard@nod.at \ --cc=robert@swiecki.net \ --cc=sasha.levin@oracle.com \ --cc=viro@zeniv.linux.org.uk \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.