From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932279AbdEDEmM (ORCPT ); Thu, 4 May 2017 00:42:12 -0400 Received: from h2.hallyn.com ([78.46.35.8]:43454 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752601AbdEDEmE (ORCPT ); Thu, 4 May 2017 00:42:04 -0400 Date: Wed, 3 May 2017 23:42:06 -0500 From: "Serge E. Hallyn" To: Kees Cook Cc: Matt Brown , Greg KH , "Serge E. Hallyn" , James Morris , Jiri Slaby , Jonathan Corbet , Andrew Morton , Jann Horn , "kernel-hardening@lists.openwall.com" , linux-security-module , LKML , "linux-doc@vger.kernel.org" Subject: Re: [kernel-hardening] Re: [PATCH v4 1/2] tiocsti-restrict : Add owner user namespace to tty_struct Message-ID: <20170504044206.GA18463@mail.hallyn.com> References: <20170424051512.20420-1-matt@nmatt.com> <20170424051512.20420-2-matt@nmatt.com> <20170424135751.GA9030@mail.hallyn.com> <20170503194528.GA28882@kroah.com> <12d91b0b-0aa9-a0d5-7cb4-83371e0e8749@nmatt.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, May 03, 2017 at 01:19:41PM -0700, Kees Cook wrote: > On Wed, May 3, 2017 at 1:02 PM, Matt Brown wrote: > > On 05/03/2017 03:45 PM, Greg KH wrote: > >> > >> On Wed, May 03, 2017 at 12:32:07PM -0700, Kees Cook wrote: > >>> > >>> On Mon, Apr 24, 2017 at 6:57 AM, Serge E. Hallyn > >>> wrote: > >>>> > >>>> Quoting Matt Brown (matt@nmatt.com): > >>>>> > >>>>> This patch adds struct user_namespace *owner_user_ns to the tty_struct. > >>>>> Then it is set to current_user_ns() in the alloc_tty_struct function. > >>>>> > >>>>> This is done to facilitate capability checks against the original user > >>>>> namespace that allocated the tty. > >>>>> > >>>>> E.g. ns_capable(tty->owner_user_ns,CAP_SYS_ADMIN) > >>>>> > >>>>> This combined with the use of user namespace's will allow hardening > >>>>> protections to be built to mitigate container escapes that utilize TTY > >>>>> ioctls such as TIOCSTI. > >>>>> > >>>>> See: https://bugzilla.redhat.com/show_bug.cgi?id=1411256 > >>>>> > >>>>> Signed-off-by: Matt Brown > >>>> > >>>> > >>>> Acked-by: Serge Hallyn > >>> > >>> > >>> This Ack didn't end up in the v5, but I think it stands, yes? > >>> > >>> Greg, is the v5 okay to pull for you or would a v6 with Acks/Reviews > >>> included be preferred? > >> > >> > >> v6 would be great, and we are dropping patch 2 from the series, right? > >> I was expecting this to be resent. I'll start looking at new patches > >> like this after 4.12-rc1 is out. > >> > > > > I will create a v6 with the Acks/Reviews. I'd like to keep patch 2 in > > since that got acked by at least Serge. (Kees also? or just patch 1?) > > Sorry, I meant that patch 2's ack from serge got dropped accidentally. > i.e. he Acked v4, but it wasn't in v5. > > Serge, just to double-check, does your Ack stand? Yes. thanks, -serge From mboxrd@z Thu Jan 1 00:00:00 1970 From: serge@hallyn.com (Serge E. Hallyn) Date: Wed, 3 May 2017 23:42:06 -0500 Subject: [kernel-hardening] Re: [PATCH v4 1/2] tiocsti-restrict : Add owner user namespace to tty_struct In-Reply-To: References: <20170424051512.20420-1-matt@nmatt.com> <20170424051512.20420-2-matt@nmatt.com> <20170424135751.GA9030@mail.hallyn.com> <20170503194528.GA28882@kroah.com> <12d91b0b-0aa9-a0d5-7cb4-83371e0e8749@nmatt.com> Message-ID: <20170504044206.GA18463@mail.hallyn.com> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org On Wed, May 03, 2017 at 01:19:41PM -0700, Kees Cook wrote: > On Wed, May 3, 2017 at 1:02 PM, Matt Brown wrote: > > On 05/03/2017 03:45 PM, Greg KH wrote: > >> > >> On Wed, May 03, 2017 at 12:32:07PM -0700, Kees Cook wrote: > >>> > >>> On Mon, Apr 24, 2017 at 6:57 AM, Serge E. Hallyn > >>> wrote: > >>>> > >>>> Quoting Matt Brown (matt at nmatt.com): > >>>>> > >>>>> This patch adds struct user_namespace *owner_user_ns to the tty_struct. > >>>>> Then it is set to current_user_ns() in the alloc_tty_struct function. > >>>>> > >>>>> This is done to facilitate capability checks against the original user > >>>>> namespace that allocated the tty. > >>>>> > >>>>> E.g. ns_capable(tty->owner_user_ns,CAP_SYS_ADMIN) > >>>>> > >>>>> This combined with the use of user namespace's will allow hardening > >>>>> protections to be built to mitigate container escapes that utilize TTY > >>>>> ioctls such as TIOCSTI. > >>>>> > >>>>> See: https://bugzilla.redhat.com/show_bug.cgi?id=1411256 > >>>>> > >>>>> Signed-off-by: Matt Brown > >>>> > >>>> > >>>> Acked-by: Serge Hallyn > >>> > >>> > >>> This Ack didn't end up in the v5, but I think it stands, yes? > >>> > >>> Greg, is the v5 okay to pull for you or would a v6 with Acks/Reviews > >>> included be preferred? > >> > >> > >> v6 would be great, and we are dropping patch 2 from the series, right? > >> I was expecting this to be resent. I'll start looking at new patches > >> like this after 4.12-rc1 is out. > >> > > > > I will create a v6 with the Acks/Reviews. I'd like to keep patch 2 in > > since that got acked by at least Serge. (Kees also? or just patch 1?) > > Sorry, I meant that patch 2's ack from serge got dropped accidentally. > i.e. he Acked v4, but it wasn't in v5. > > Serge, just to double-check, does your Ack stand? Yes. thanks, -serge -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Wed, 3 May 2017 23:42:06 -0500 From: "Serge E. Hallyn" Message-ID: <20170504044206.GA18463@mail.hallyn.com> References: <20170424051512.20420-1-matt@nmatt.com> <20170424051512.20420-2-matt@nmatt.com> <20170424135751.GA9030@mail.hallyn.com> <20170503194528.GA28882@kroah.com> <12d91b0b-0aa9-a0d5-7cb4-83371e0e8749@nmatt.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Subject: Re: [kernel-hardening] Re: [PATCH v4 1/2] tiocsti-restrict : Add owner user namespace to tty_struct To: Kees Cook Cc: Matt Brown , Greg KH , "Serge E. Hallyn" , James Morris , Jiri Slaby , Jonathan Corbet , Andrew Morton , Jann Horn , "kernel-hardening@lists.openwall.com" , linux-security-module , LKML , "linux-doc@vger.kernel.org" List-ID: On Wed, May 03, 2017 at 01:19:41PM -0700, Kees Cook wrote: > On Wed, May 3, 2017 at 1:02 PM, Matt Brown wrote: > > On 05/03/2017 03:45 PM, Greg KH wrote: > >> > >> On Wed, May 03, 2017 at 12:32:07PM -0700, Kees Cook wrote: > >>> > >>> On Mon, Apr 24, 2017 at 6:57 AM, Serge E. Hallyn > >>> wrote: > >>>> > >>>> Quoting Matt Brown (matt@nmatt.com): > >>>>> > >>>>> This patch adds struct user_namespace *owner_user_ns to the tty_struct. > >>>>> Then it is set to current_user_ns() in the alloc_tty_struct function. > >>>>> > >>>>> This is done to facilitate capability checks against the original user > >>>>> namespace that allocated the tty. > >>>>> > >>>>> E.g. ns_capable(tty->owner_user_ns,CAP_SYS_ADMIN) > >>>>> > >>>>> This combined with the use of user namespace's will allow hardening > >>>>> protections to be built to mitigate container escapes that utilize TTY > >>>>> ioctls such as TIOCSTI. > >>>>> > >>>>> See: https://bugzilla.redhat.com/show_bug.cgi?id=1411256 > >>>>> > >>>>> Signed-off-by: Matt Brown > >>>> > >>>> > >>>> Acked-by: Serge Hallyn > >>> > >>> > >>> This Ack didn't end up in the v5, but I think it stands, yes? > >>> > >>> Greg, is the v5 okay to pull for you or would a v6 with Acks/Reviews > >>> included be preferred? > >> > >> > >> v6 would be great, and we are dropping patch 2 from the series, right? > >> I was expecting this to be resent. I'll start looking at new patches > >> like this after 4.12-rc1 is out. > >> > > > > I will create a v6 with the Acks/Reviews. I'd like to keep patch 2 in > > since that got acked by at least Serge. (Kees also? or just patch 1?) > > Sorry, I meant that patch 2's ack from serge got dropped accidentally. > i.e. he Acked v4, but it wasn't in v5. > > Serge, just to double-check, does your Ack stand? Yes. thanks, -serge