All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Reshetova, Elena" <elena.reshetova@intel.com>
To: "kernel-hardening@lists.openwall.com"
	<kernel-hardening@lists.openwall.com>
Cc: "linux-security-module@vger.kernel.org"
	<linux-security-module@vger.kernel.org>,
	"keescook@chromium.org" <keescook@chromium.org>,
	"spender@grsecurity.net" <spender@grsecurity.net>,
	"jmorris@namei.org" <jmorris@namei.org>,
	"Schaufler, Casey" <casey.schaufler@intel.com>,
	"Leibowitz, Michael" <michael.leibowitz@intel.com>,
	"Roberts, William C" <william.c.roberts@intel.com>
Subject: RE: [kernel-hardening] [RFC] [PATCH 4/5] invoke path_chroot() LSM hook on mntns_install()
Date: Mon, 1 Aug 2016 09:26:17 +0000	[thread overview]
Message-ID: <2236FBA76BA1254E88B949DDB74E612B41B70552@IRSMSX102.ger.corp.intel.com> (raw)
In-Reply-To: <20160731112927.GA14676@pc.thejh.net>

[-- Attachment #1: Type: text/plain, Size: 2177 bytes --]


On Sun, Jul 31, 2016 at 10:39:04AM +0000, Reshetova, Elena wrote:
> On Fri, Jul 29, 2016 at 10:34:39AM +0300, Elena Reshetova wrote:
> > This adds an additional invocation of the security_path_chroot LSM 
> > hook inside mntns_install().
> > Currently only capabilities are checked at this point, while process 
> > root actually changes.
> 
> >Are you aware that unprivileged user namespace creation doesn't work 
> >in a
> chrooted process? See the invocation of current_chrooted() in 
> create_user_ns(). This means that for this new LSM hook to make any 
> sense, a namespace admin has to attempt >to sandbox himself with chroot().
> 
> I am not sure I understand you fully here. It is possible to create 
> new mount namespace without creating new user namespace, and when this 
> happens, if I understand the code right, there is no check like 
> current_chrooted() or smth like this.
> So, how does it relate to user namespace? 

>You can only create a new mount namespace if you're privileged relative to
your current namespace. See the second and third invocation of ns_capable()
in mntns_install(). To get those privileges, you have to either be
privileged already or unshare the user namespace to get new namespaced
privileges.
An unprivileged, chrooted process doesn't have existing privileges and can't
unshare the user namespace to get new ones, so it can't unshare other
namespaces (like the mount namespace) anymore.

Yes, all true, I just got confused that you said that checks for chroot are
done. So, yes, you need to have CAP_SYS_ADMIN in current namespace, and then
you can get your new mount ns. 
After thinking more on this, I think I will get rid of this altogether. Yes,
there is a case when a process first enters a new user ns, then enters
chroot and forgets to drop its caps. Then it runs for a while, gets
exploited and now it tries to get out of chroot. It can create a new mount
ns since it has CAP_SYS_ADMIN in his user ns, but what is the outcome?
Probably not much, it certainly doesn't help it much from chroot
perspective. And I can't think of a reason why a legitimate process would
want to create a new namespace inside the chroot.... 
 

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 7586 bytes --]

  reply	other threads:[~2016-08-01  9:26 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-07-29  7:34 [kernel-hardening] [RFC] [PATCH 0/5] Hardchroot LSM + additional hooks Elena Reshetova
2016-07-29  7:34 ` [kernel-hardening] [RFC] [PATCH 1/5] path_fchdir and path_fhandle LSM hooks Elena Reshetova
2016-07-29 18:12   ` Jann Horn
2016-07-31 10:55     ` Reshetova, Elena
2016-07-31 12:02       ` Jann Horn
2016-07-31 18:28         ` Reshetova, Elena
2016-07-31 21:23           ` Jann Horn
2016-08-01  8:38             ` Reshetova, Elena
2016-07-29  7:34 ` [kernel-hardening] [RFC] [PATCH 2/5] task_unshare LSM hook Elena Reshetova
2016-07-29 17:58   ` Jann Horn
2016-07-29 18:17     ` Reshetova, Elena
2016-07-29  7:34 ` [kernel-hardening] [RFC] [PATCH 3/5] sb_unsharefs " Elena Reshetova
2016-07-29 18:02   ` Jann Horn
2016-07-29 18:09     ` Reshetova, Elena
2016-07-29 18:15   ` Jann Horn
2016-07-29 18:19     ` Reshetova, Elena
2016-07-29  7:34 ` [kernel-hardening] [RFC] [PATCH 4/5] invoke path_chroot() LSM hook on mntns_install() Elena Reshetova
2016-07-29 18:11   ` Jann Horn
2016-07-31 10:39     ` Reshetova, Elena
2016-07-31 11:29       ` Jann Horn
2016-08-01  9:26         ` Reshetova, Elena [this message]
2016-07-29  7:34 ` [kernel-hardening] [RFC] [PATCH 5/5] Hardchroot LSM Elena Reshetova
2016-07-29 11:44   ` [kernel-hardening] " Brad Spengler
2016-07-29 12:15     ` [kernel-hardening] " Reshetova, Elena
2016-07-29 12:25     ` Reshetova, Elena
2016-07-29 18:53   ` [kernel-hardening] " Jann Horn
2016-07-29 19:20     ` Casey Schaufler
2016-07-29 20:53       ` Jann Horn
2016-07-29 21:10         ` Casey Schaufler
2016-07-29 21:50           ` Jann Horn
2016-07-30  6:10     ` Reshetova, Elena
2016-08-03  6:36 ` [kernel-hardening] Re: [RFC] [PATCH 0/5] Hardchroot LSM + additional hooks James Morris
2016-08-05  7:53   ` [kernel-hardening] " Reshetova, Elena

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2236FBA76BA1254E88B949DDB74E612B41B70552@IRSMSX102.ger.corp.intel.com \
    --to=elena.reshetova@intel.com \
    --cc=casey.schaufler@intel.com \
    --cc=jmorris@namei.org \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=linux-security-module@vger.kernel.org \
    --cc=michael.leibowitz@intel.com \
    --cc=spender@grsecurity.net \
    --cc=william.c.roberts@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.