* [obsolete] proc-sysctl-make-protected_-world-readable.patch removed from -mm tree
@ 2022-04-25 21:46 Andrew Morton
2022-05-12 18:58 ` Luis Chamberlain
0 siblings, 1 reply; 3+ messages in thread
From: Andrew Morton @ 2022-04-25 21:46 UTC (permalink / raw)
To: mm-commits, yzaikin, viro, mingo, mcgrof, keescook, jpitti, akpm
The patch titled
Subject: proc/sysctl: make protected_* world readable
has been removed from the -mm tree. Its filename was
proc-sysctl-make-protected_-world-readable.patch
This patch was dropped because it is obsolete
------------------------------------------------------
From: Julius Hemanth Pitti <jpitti@cisco.com>
Subject: proc/sysctl: make protected_* world readable
protected_* files have 600 permissions which prevents non-superuser from
reading them.
Container like "AWS greengrass" refuse to launch unless
protected_hardlinks and protected_symlinks are set. When containers like
these run with "userns-remap" or "--user" mapping container's root to
non-superuser on host, they fail to run due to denied read access to these
files.
As these protections are hardly a secret, and do not possess any security
risk, making them world readable.
Though above greengrass usecase needs read access to only
protected_hardlinks and protected_symlinks files, setting all other
protected_* files to 644 to keep consistency.
Link: http://lkml.kernel.org/r/20200709235115.56954-1-jpitti@cisco.com
Fixes: 800179c9b8a1 ("fs: add link restrictions")
Signed-off-by: Julius Hemanth Pitti <jpitti@cisco.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Iurii Zaikin <yzaikin@google.com>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
fs/namei.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/fs/namei.c~proc-sysctl-make-protected_-world-readable
+++ a/fs/namei.c
@@ -1031,7 +1031,7 @@ static struct ctl_table namei_sysctls[]
.procname = "protected_symlinks",
.data = &sysctl_protected_symlinks,
.maxlen = sizeof(int),
- .mode = 0600,
+ .mode = 0644,
.proc_handler = proc_dointvec_minmax,
.extra1 = SYSCTL_ZERO,
.extra2 = SYSCTL_ONE,
@@ -1040,7 +1040,7 @@ static struct ctl_table namei_sysctls[]
.procname = "protected_hardlinks",
.data = &sysctl_protected_hardlinks,
.maxlen = sizeof(int),
- .mode = 0600,
+ .mode = 0644,
.proc_handler = proc_dointvec_minmax,
.extra1 = SYSCTL_ZERO,
.extra2 = SYSCTL_ONE,
@@ -1049,7 +1049,7 @@ static struct ctl_table namei_sysctls[]
.procname = "protected_fifos",
.data = &sysctl_protected_fifos,
.maxlen = sizeof(int),
- .mode = 0600,
+ .mode = 0644,
.proc_handler = proc_dointvec_minmax,
.extra1 = SYSCTL_ZERO,
.extra2 = SYSCTL_TWO,
@@ -1058,7 +1058,7 @@ static struct ctl_table namei_sysctls[]
.procname = "protected_regular",
.data = &sysctl_protected_regular,
.maxlen = sizeof(int),
- .mode = 0600,
+ .mode = 0644,
.proc_handler = proc_dointvec_minmax,
.extra1 = SYSCTL_ZERO,
.extra2 = SYSCTL_TWO,
_
Patches currently in -mm which might be from jpitti@cisco.com are
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [obsolete] proc-sysctl-make-protected_-world-readable.patch removed from -mm tree
2022-04-25 21:46 [obsolete] proc-sysctl-make-protected_-world-readable.patch removed from -mm tree Andrew Morton
@ 2022-05-12 18:58 ` Luis Chamberlain
2022-05-12 19:20 ` Andrew Morton
0 siblings, 1 reply; 3+ messages in thread
From: Luis Chamberlain @ 2022-05-12 18:58 UTC (permalink / raw)
To: Andrew Morton; +Cc: mm-commits, yzaikin, viro, mingo, keescook, jpitti
Hi Andrew,
I've reivewed this now and you can add:
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Luis
On Mon, Apr 25, 2022 at 02:46:51PM -0700, Andrew Morton wrote:
>
> The patch titled
> Subject: proc/sysctl: make protected_* world readable
> has been removed from the -mm tree. Its filename was
> proc-sysctl-make-protected_-world-readable.patch
>
> This patch was dropped because it is obsolete
>
> ------------------------------------------------------
> From: Julius Hemanth Pitti <jpitti@cisco.com>
> Subject: proc/sysctl: make protected_* world readable
>
> protected_* files have 600 permissions which prevents non-superuser from
> reading them.
>
> Container like "AWS greengrass" refuse to launch unless
> protected_hardlinks and protected_symlinks are set. When containers like
> these run with "userns-remap" or "--user" mapping container's root to
> non-superuser on host, they fail to run due to denied read access to these
> files.
>
> As these protections are hardly a secret, and do not possess any security
> risk, making them world readable.
>
> Though above greengrass usecase needs read access to only
> protected_hardlinks and protected_symlinks files, setting all other
> protected_* files to 644 to keep consistency.
>
> Link: http://lkml.kernel.org/r/20200709235115.56954-1-jpitti@cisco.com
> Fixes: 800179c9b8a1 ("fs: add link restrictions")
> Signed-off-by: Julius Hemanth Pitti <jpitti@cisco.com>
> Acked-by: Kees Cook <keescook@chromium.org>
> Cc: Iurii Zaikin <yzaikin@google.com>
> Cc: Luis Chamberlain <mcgrof@kernel.org>
> Cc: Ingo Molnar <mingo@elte.hu>
> Cc: Al Viro <viro@zeniv.linux.org.uk>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---
>
> fs/namei.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> --- a/fs/namei.c~proc-sysctl-make-protected_-world-readable
> +++ a/fs/namei.c
> @@ -1031,7 +1031,7 @@ static struct ctl_table namei_sysctls[]
> .procname = "protected_symlinks",
> .data = &sysctl_protected_symlinks,
> .maxlen = sizeof(int),
> - .mode = 0600,
> + .mode = 0644,
> .proc_handler = proc_dointvec_minmax,
> .extra1 = SYSCTL_ZERO,
> .extra2 = SYSCTL_ONE,
> @@ -1040,7 +1040,7 @@ static struct ctl_table namei_sysctls[]
> .procname = "protected_hardlinks",
> .data = &sysctl_protected_hardlinks,
> .maxlen = sizeof(int),
> - .mode = 0600,
> + .mode = 0644,
> .proc_handler = proc_dointvec_minmax,
> .extra1 = SYSCTL_ZERO,
> .extra2 = SYSCTL_ONE,
> @@ -1049,7 +1049,7 @@ static struct ctl_table namei_sysctls[]
> .procname = "protected_fifos",
> .data = &sysctl_protected_fifos,
> .maxlen = sizeof(int),
> - .mode = 0600,
> + .mode = 0644,
> .proc_handler = proc_dointvec_minmax,
> .extra1 = SYSCTL_ZERO,
> .extra2 = SYSCTL_TWO,
> @@ -1058,7 +1058,7 @@ static struct ctl_table namei_sysctls[]
> .procname = "protected_regular",
> .data = &sysctl_protected_regular,
> .maxlen = sizeof(int),
> - .mode = 0600,
> + .mode = 0644,
> .proc_handler = proc_dointvec_minmax,
> .extra1 = SYSCTL_ZERO,
> .extra2 = SYSCTL_TWO,
> _
>
> Patches currently in -mm which might be from jpitti@cisco.com are
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [obsolete] proc-sysctl-make-protected_-world-readable.patch removed from -mm tree
2022-05-12 18:58 ` Luis Chamberlain
@ 2022-05-12 19:20 ` Andrew Morton
0 siblings, 0 replies; 3+ messages in thread
From: Andrew Morton @ 2022-05-12 19:20 UTC (permalink / raw)
To: Luis Chamberlain; +Cc: mm-commits, yzaikin, viro, mingo, keescook, jpitti
On Thu, 12 May 2022 11:58:51 -0700 Luis Chamberlain <mcgrof@kernel.org> wrote:
> I've reivewed this now and you can add:
>
> Acked-by: Luis Chamberlain <mcgrof@kernel.org>
OK, thanks, I brought it back.
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/proc-sysctl-make-protected_-world-readable.patch
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-05-12 19:20 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-04-25 21:46 [obsolete] proc-sysctl-make-protected_-world-readable.patch removed from -mm tree Andrew Morton
2022-05-12 18:58 ` Luis Chamberlain
2022-05-12 19:20 ` Andrew Morton
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.