From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S942505AbcJSR3Z (ORCPT ); Wed, 19 Oct 2016 13:29:25 -0400 Received: from thejh.net ([37.221.195.125]:43398 "EHLO thejh.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S938820AbcJSR3X (ORCPT ); Wed, 19 Oct 2016 13:29:23 -0400 Date: Wed, 19 Oct 2016 19:29:17 +0200 From: Jann Horn To: "Eric W. Biederman" Cc: Andy Lutomirski , Michal Hocko , "linux-kernel@vger.kernel.org" , Linux Containers , Oleg Nesterov , "linux-mm@kvack.org" , Linux FS Devel Subject: Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. Message-ID: <20161019172917.GE1210@laptop.thejh.net> References: <87twcbq696.fsf@x220.int.ebiederm.org> <20161018135031.GB13117@dhcp22.suse.cz> <8737jt903u.fsf@xmission.com> <20161018150507.GP14666@pc.thejh.net> <87twc9656s.fsf@xmission.com> <20161018191206.GA1210@laptop.thejh.net> <87r37dnz74.fsf@xmission.com> <87k2d5nytz.fsf_-_@xmission.com> <87y41kjn6l.fsf@xmission.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87y41kjn6l.fsf@xmission.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Oct 19, 2016 at 11:52:50AM -0500, Eric W. Biederman wrote: > Andy Lutomirski writes: > > Simply ptrace yourself, exec the > > program, and then dump the program out. A program that really wants > > to be unreadable should have a stub: the stub is setuid and readable, > > but all the stub does is to exec the real program, and the real > > program should have mode 0500 or similar. > > > > ISTM the "right" check would be to enforce that the program's new > > creds can read the program, but that will break backwards > > compatibility. > > Last I looked I had the impression that exec of a setuid program kills > the ptrace. > > If we are talking about a exec of a simple unreadable executable (aka > something that sets undumpable but is not setuid or setgid). Then I > agree it should break the ptrace as well and since those programs are as > rare as hens teeth I don't see any problem with changing the ptrace behavior > in that case. Nope. check_unsafe_exec() sets LSM_UNSAFE_* flags in bprm->unsafe, and then the flags are checked by the LSMs and cap_bprm_set_creds() in commoncap.c. cap_bprm_set_creds() just degrades the execution to a non-setuid-ish one, and e.g. ptracers stay attached. Same thing happens if the fs struct is shared with another process or if NO_NEW_PRIVS is active. (Actually, it's still a bit like normal setuid execution: IIRC AT_SECURE stays active, and the resulting process still won't be dumpable, so it's not possible for a *new* ptracer to attach afterwards. But this is just from memory, I'm not entirely sure.) From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Wed, 19 Oct 2016 19:29:17 +0200 From: Jann Horn To: "Eric W. Biederman" Cc: Andy Lutomirski , Michal Hocko , "linux-kernel@vger.kernel.org" , Linux Containers , Oleg Nesterov , "linux-mm@kvack.org" , Linux FS Devel Subject: Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. Message-ID: <20161019172917.GE1210@laptop.thejh.net> References: <87twcbq696.fsf@x220.int.ebiederm.org> <20161018135031.GB13117@dhcp22.suse.cz> <8737jt903u.fsf@xmission.com> <20161018150507.GP14666@pc.thejh.net> <87twc9656s.fsf@xmission.com> <20161018191206.GA1210@laptop.thejh.net> <87r37dnz74.fsf@xmission.com> <87k2d5nytz.fsf_-_@xmission.com> <87y41kjn6l.fsf@xmission.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87y41kjn6l.fsf@xmission.com> Sender: owner-linux-mm@kvack.org List-ID: On Wed, Oct 19, 2016 at 11:52:50AM -0500, Eric W. Biederman wrote: > Andy Lutomirski writes: > > Simply ptrace yourself, exec the > > program, and then dump the program out. A program that really wants > > to be unreadable should have a stub: the stub is setuid and readable, > > but all the stub does is to exec the real program, and the real > > program should have mode 0500 or similar. > > > > ISTM the "right" check would be to enforce that the program's new > > creds can read the program, but that will break backwards > > compatibility. > > Last I looked I had the impression that exec of a setuid program kills > the ptrace. > > If we are talking about a exec of a simple unreadable executable (aka > something that sets undumpable but is not setuid or setgid). Then I > agree it should break the ptrace as well and since those programs are as > rare as hens teeth I don't see any problem with changing the ptrace behavior > in that case. Nope. check_unsafe_exec() sets LSM_UNSAFE_* flags in bprm->unsafe, and then the flags are checked by the LSMs and cap_bprm_set_creds() in commoncap.c. cap_bprm_set_creds() just degrades the execution to a non-setuid-ish one, and e.g. ptracers stay attached. Same thing happens if the fs struct is shared with another process or if NO_NEW_PRIVS is active. (Actually, it's still a bit like normal setuid execution: IIRC AT_SECURE stays active, and the resulting process still won't be dumpable, so it's not possible for a *new* ptracer to attach afterwards. But this is just from memory, I'm not entirely sure.) -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org