All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ben Hutchings <ben@decadent.org.uk>
To: kernel-hardening@lists.openwall.com,
	"Robert Święcki" <robert@swiecki.net>,
	"Serge E. Hallyn" <serge.hallyn@ubuntu.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
	Al Viro <viro@zeniv.linux.org.uk>,
	Richard Weinberger <richard@nod.at>,
	"Eric W. Biederman" <ebiederm@xmission.com>,
	Andy Lutomirski <luto@amacapital.net>,
	Dmitry Vyukov <dvyukov@google.com>,
	David Howells <dhowells@redhat.com>,
	Kostya Serebryany <kcc@google.com>,
	Alexander Potapenko <glider@google.com>,
	Eric Dumazet <edumazet@google.com>,
	Sasha Levin <sasha.levin@oracle.com>,
	"linux-doc@vger.kernel.org" <linux-doc@vger.kernel.org>,
	LKML <linux-kernel@vger.kernel.org>
Subject: Re: [kernel-hardening] Re: [PATCH 2/2] sysctl: allow CLONE_NEWUSER to be disabled
Date: Sat, 23 Jan 2016 00:59:59 +0000	[thread overview]
Message-ID: <1453510799.3734.153.camel@decadent.org.uk> (raw)
In-Reply-To: <CAGXu5jKbroEt0nO=yA4V6esKePseO75tcsK=YVy-=1NEuzwxzQ@mail.gmail.com>

[-- Attachment #1: Type: text/plain, Size: 1639 bytes --]

On Fri, 2016-01-22 at 15:00 -0800, Kees Cook wrote:
> On Fri, Jan 22, 2016 at 2:55 PM, Robert Święcki <robert@swiecki.net> wrote:
> > 2016-01-22 23:50 GMT+01:00 Kees Cook <keescook@chromium.org>:
> > 
> > > > Seems that Debian and some older Ubuntu versions are already using
> > > > 
> > > > $ sysctl -a | grep usern
> > > > kernel.unprivileged_userns_clone = 0
> > > > 
> > > > Shall we be consistent wit it?
> > > 
> > > Oh! I didn't see that on systems I checked. On which version did you find that?
> > 
> > $ uname -a
> > Linux bc1 4.3.0-0.bpo.1-amd64 #1 SMP Debian 4.3.3-5~bpo8+1
> > (2016-01-07) x86_64 GNU/Linux
> > $ cat /etc/debian_version
> > 8.2
> 
> Ah-ha, Debian only, though it looks like this was just committed to
> the Ubuntu kernel tree too:
> 
> 
> > IIRC some older kernels delivered with Ubuntu Precise were also using
> > it (but maybe I'm mistaken)
> 
> I don't see it there.
> 
> I think my patch is more complete, but I'm happy to change the name if
> this sysctl has already started to enter the global consciousness. ;)
> 
> Serge, Ben, what do you think?

I agree that using the '_restrict' suffix for new restrictions makes
sense.  I also don't think that a third possible value for
kernel.unprivileged_userns_clone would would be understandable.

I would probably make kernel.unprivileged_userns_clone a wrapper for
kernel.userns_restrict in Debian, then deprecate and eventually remove
it.

Ben.

-- 
Ben Hutchings
Life is what happens to you while you're busy making other plans.
                                                               - John Lennon

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]

  parent reply	other threads:[~2016-01-23  1:00 UTC|newest]

Thread overview: 80+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-01-22 22:39 [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Kees Cook
2016-01-22 22:39 ` [kernel-hardening] " Kees Cook
2016-01-22 22:39 ` [PATCH 1/2] sysctl: expand use of proc_dointvec_minmax_sysadmin Kees Cook
2016-01-22 22:39   ` [kernel-hardening] " Kees Cook
2016-01-23  3:10   ` Eric W. Biederman
2016-01-23  3:10     ` [kernel-hardening] " Eric W. Biederman
2016-01-23 22:25     ` Jann Horn
2016-01-24  1:20       ` Eric W. Biederman
2016-01-24  1:43         ` Al Viro
2016-01-24  1:56           ` Jann Horn
2016-01-24  6:02             ` Eric W. Biederman
2016-01-24  6:32               ` Jann Horn
2016-01-24  6:44                 ` Eric W. Biederman
2016-01-22 22:39 ` [PATCH 2/2] sysctl: allow CLONE_NEWUSER to be disabled Kees Cook
2016-01-22 22:39   ` [kernel-hardening] " Kees Cook
2016-01-22 22:47   ` Robert Święcki
2016-01-22 22:47     ` [kernel-hardening] " Robert Święcki
2016-01-22 22:50     ` Kees Cook
2016-01-22 22:50       ` [kernel-hardening] " Kees Cook
2016-01-22 22:55       ` Robert Święcki
2016-01-22 22:55         ` [kernel-hardening] " Robert Święcki
2016-01-22 23:00         ` Kees Cook
2016-01-22 23:00           ` [kernel-hardening] " Kees Cook
2016-01-23  0:44           ` Serge Hallyn
2016-01-23  0:44             ` [kernel-hardening] " Serge Hallyn
2016-01-23  0:44           ` Serge Hallyn
2016-01-23  0:44             ` [kernel-hardening] " Serge Hallyn
2016-01-23  0:59           ` Ben Hutchings [this message]
2016-01-24 20:59             ` Kees Cook
2016-01-24 20:59               ` Kees Cook
2016-01-24 22:20               ` Andy Lutomirski
2016-01-25 18:51                 ` Kees Cook
2016-01-22 22:49 ` [PATCH 0/2] " Richard Weinberger
2016-01-22 22:49   ` [kernel-hardening] " Richard Weinberger
2016-01-23  3:02 ` Eric W. Biederman
2016-01-23  3:02   ` [kernel-hardening] " Eric W. Biederman
2016-01-24 20:57   ` Kees Cook
2016-01-24 20:57     ` [kernel-hardening] " Kees Cook
2016-01-26  7:38     ` Serge Hallyn
2016-01-24 22:22   ` Andy Lutomirski
2016-01-24 22:22     ` [kernel-hardening] " Andy Lutomirski
2016-01-25 18:51     ` Kees Cook
2016-01-25 18:51       ` [kernel-hardening] " Kees Cook
2016-01-25 18:53       ` Andy Lutomirski
2016-01-25 18:53         ` [kernel-hardening] " Andy Lutomirski
2016-01-25 18:56         ` Kees Cook
2016-01-25 18:56           ` [kernel-hardening] " Kees Cook
2016-01-25 19:33           ` Eric W. Biederman
2016-01-25 19:33             ` [kernel-hardening] " Eric W. Biederman
2016-01-25 22:34             ` Kees Cook
2016-01-25 22:34               ` [kernel-hardening] " Kees Cook
2016-01-25 23:33               ` Andy Lutomirski
2016-01-25 23:33                 ` [kernel-hardening] " Andy Lutomirski
2016-01-26  2:27               ` Daniel Micay
2016-01-26  4:57               ` Eric W. Biederman
2016-01-26  4:57                 ` [kernel-hardening] " Eric W. Biederman
2016-01-26 14:38                 ` Josh Boyer
2016-01-26 14:38                   ` [kernel-hardening] " Josh Boyer
2016-01-26 14:46                   ` Austin S. Hemmelgarn
2016-01-26 14:46                     ` [kernel-hardening] " Austin S. Hemmelgarn
2016-01-26 14:56                     ` Josh Boyer
2016-01-26 14:56                       ` [kernel-hardening] " Josh Boyer
2016-01-26 17:20                       ` Serge Hallyn
2016-01-26 19:56                         ` Josh Boyer
2016-01-26 20:11                           ` Austin S. Hemmelgarn
2016-01-26 17:15                   ` Serge Hallyn
2016-01-26 18:09                     ` Austin S. Hemmelgarn
2016-01-26 18:27                       ` Andy Lutomirski
2016-01-26 18:45                         ` Austin S. Hemmelgarn
2016-01-26 23:15                         ` Kees Cook
2016-01-26 23:13                     ` Kees Cook
2016-01-27 10:27                       ` Eric W. Biederman
2016-01-27 12:32                         ` Austin S. Hemmelgarn
2016-01-28 14:41                         ` Robert Święcki
2016-01-28 14:41                           ` Robert Święcki
2016-01-26 23:47                     ` Josh Boyer
2016-01-26 16:37                 ` Kees Cook
2016-01-26 16:37                   ` [kernel-hardening] " Kees Cook
2016-01-28  8:56                 ` Serge E. Hallyn
2016-01-28 12:53                   ` Austin S. Hemmelgarn

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1453510799.3734.153.camel@decadent.org.uk \
    --to=ben@decadent.org.uk \
    --cc=akpm@linux-foundation.org \
    --cc=dhowells@redhat.com \
    --cc=dvyukov@google.com \
    --cc=ebiederm@xmission.com \
    --cc=edumazet@google.com \
    --cc=glider@google.com \
    --cc=kcc@google.com \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@amacapital.net \
    --cc=richard@nod.at \
    --cc=robert@swiecki.net \
    --cc=sasha.levin@oracle.com \
    --cc=serge.hallyn@ubuntu.com \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.