Re: [kernel-hardening] [RFC] [PATCH 4/5] invoke path_chroot() LSM hook on mntns_install()

From: Jann Horn <jann@thejh.net>
To: "Reshetova, Elena" <elena.reshetova@intel.com>
Cc: "kernel-hardening@lists.openwall.com"
	<kernel-hardening@lists.openwall.com>,
	"linux-security-module@vger.kernel.org"
	<linux-security-module@vger.kernel.org>,
	"keescook@chromium.org" <keescook@chromium.org>,
	"spender@grsecurity.net" <spender@grsecurity.net>,
	"jmorris@namei.org" <jmorris@namei.org>,
	"Schaufler, Casey" <casey.schaufler@intel.com>,
	"Leibowitz, Michael" <michael.leibowitz@intel.com>,
	"Roberts, William C" <william.c.roberts@intel.com>
Subject: Re: [kernel-hardening] [RFC] [PATCH 4/5] invoke path_chroot() LSM hook on mntns_install()
Date: Sun, 31 Jul 2016 13:29:27 +0200	[thread overview]
Message-ID: <20160731112927.GA14676@pc.thejh.net> (raw)
In-Reply-To: <2236FBA76BA1254E88B949DDB74E612B41B70283@IRSMSX102.ger.corp.intel.com>

[-- Attachment #1: Type: text/plain, Size: 1999 bytes --]

On Sun, Jul 31, 2016 at 10:39:04AM +0000, Reshetova, Elena wrote:
> On Fri, Jul 29, 2016 at 10:34:39AM +0300, Elena Reshetova wrote:
> > This adds an additional invocation of the security_path_chroot LSM 
> > hook inside mntns_install().
> > Currently only capabilities are checked at this point, while process 
> > root actually changes.
> 
> >Are you aware that unprivileged user namespace creation doesn't work in a
> chrooted process? See the invocation of current_chrooted() in
> create_user_ns(). This means that for this new LSM hook to make any sense, a
> namespace admin has to attempt >to sandbox himself with chroot().
> 
> I am not sure I understand you fully here. It is possible to create new
> mount namespace without creating new user namespace, and when this happens,
> if I understand the code right, there is no check like current_chrooted() or
> smth like this. 
> So, how does it relate to user namespace? 

You can only create a new mount namespace if you're privileged relative to
your current namespace. See the second and third invocation of ns_capable() in
mntns_install(). To get those privileges, you have to either be privileged
already or unshare the user namespace to get new namespaced privileges.
An unprivileged, chrooted process doesn't have existing privileges and can't
unshare the user namespace to get new ones, so it can't unshare other
namespaces (like the mount namespace) anymore.

> >If the current namespace is the init namespace, the process has
> CAP_SYS_ADMIN in the init namespace, meaning that filesystem sandboxing is
> probably useless.
> >If the current namespace is not the init namespace, the process probably
> used namespaces to sandbox itself, in which case it wouldn't be using chroot
> in the first place, 
> Why? It is possible that we might be running in the namespace some daemon
> which just uses chroot by default (legacy or whatever). I think you even
> proposed that in another email. 

True.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]