From: "Austin S. Hemmelgarn" <ahferroin7@gmail.com>
To: "Serge E. Hallyn" <serge.hallyn@ubuntu.com>,
kernel-hardening@lists.openwall.com
Cc: "Kees Cook" <keescook@chromium.org>,
"Andy Lutomirski" <luto@amacapital.net>,
"Andrew Morton" <akpm@linux-foundation.org>,
"Al Viro" <viro@zeniv.linux.org.uk>,
"Richard Weinberger" <richard@nod.at>,
"Robert Święcki" <robert@swiecki.net>,
"Dmitry Vyukov" <dvyukov@google.com>,
"David Howells" <dhowells@redhat.com>,
"Miklos Szeredi" <mszeredi@suse.cz>,
"Kostya Serebryany" <kcc@google.com>,
"Alexander Potapenko" <glider@google.com>,
"Eric Dumazet" <edumazet@google.com>,
"Sasha Levin" <sasha.levin@oracle.com>,
"linux-doc@vger.kernel.org" <linux-doc@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled
Date: Thu, 28 Jan 2016 07:53:54 -0500 [thread overview]
Message-ID: <56AA0F62.7090905@gmail.com> (raw)
In-Reply-To: <20160128085655.GA9955@mail.hallyn.com>
On 2016-01-28 03:56, Serge E. Hallyn wrote:
> On Mon, Jan 25, 2016 at 10:57:32PM -0600, Eric W. Biederman wrote:
>> What sounds like a generally useful feature that would cover your use
>> case and many others is a per user limit on the number of user
>> namespaces users may create.
>
> Ok, I'm sorry, but after thinking about this quite awhile, I think this
> is a bad idea. If I'm allowed to create exactly one, then (a) I won't
> be able to run two instances of chrome (does chrome use one userns per
> tab or per application?), yet (b) i can easily just not use chrome and
> use my allocation to run a vulnerability.
Ignore regular users WRT the ability to limit to one or two namespace
instances, the advantage of being able to limit to one or two user
namespaces for a given user is that it prevents daemons that use it for
sand-boxing from being exploited to create more. If we go with Eric's
suggestion, there is absolutely no reason on a regular desktop system
that the users used for a graphical login would have to be limited.
>
> IMO, having a (hopefully temporary, so cleanly separated out) sysctl,
> which perhaps goes so far as to kill all non-init user namespaces when
> set to -1, makes the most sense. I still think the harm due to having
> userspace not being able to rely on user namespaces will, long term, be
> worse than the security implications of having user namespaces always
> enabled.
Userspace can't rely on them as it is right now. The default kernel
config has them disabled, and a number of distros are refusing to ship
kernels with them enabled at least in the short term, wheras a number
are only shipping kernels with them enabled (I'd be willing to bet that
part of what prompted this originally was Chrome). Just by virtue of
this, you can't rely on them being there and need to gracefully handle
the situation if they aren't. Adding a sysctl allowing them to be
disabled completely on a kernel that has support built in would not make
them all that much more unreliable than they already are.
prev parent reply other threads:[~2016-01-28 12:55 UTC|newest]
Thread overview: 80+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-22 22:39 [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Kees Cook
2016-01-22 22:39 ` [kernel-hardening] " Kees Cook
2016-01-22 22:39 ` [PATCH 1/2] sysctl: expand use of proc_dointvec_minmax_sysadmin Kees Cook
2016-01-22 22:39 ` [kernel-hardening] " Kees Cook
2016-01-23 3:10 ` Eric W. Biederman
2016-01-23 3:10 ` [kernel-hardening] " Eric W. Biederman
2016-01-23 22:25 ` Jann Horn
2016-01-24 1:20 ` Eric W. Biederman
2016-01-24 1:43 ` Al Viro
2016-01-24 1:56 ` Jann Horn
2016-01-24 6:02 ` Eric W. Biederman
2016-01-24 6:32 ` Jann Horn
2016-01-24 6:44 ` Eric W. Biederman
2016-01-22 22:39 ` [PATCH 2/2] sysctl: allow CLONE_NEWUSER to be disabled Kees Cook
2016-01-22 22:39 ` [kernel-hardening] " Kees Cook
2016-01-22 22:47 ` Robert Święcki
2016-01-22 22:47 ` [kernel-hardening] " Robert Święcki
2016-01-22 22:50 ` Kees Cook
2016-01-22 22:50 ` [kernel-hardening] " Kees Cook
2016-01-22 22:55 ` Robert Święcki
2016-01-22 22:55 ` [kernel-hardening] " Robert Święcki
2016-01-22 23:00 ` Kees Cook
2016-01-22 23:00 ` [kernel-hardening] " Kees Cook
2016-01-23 0:44 ` Serge Hallyn
2016-01-23 0:44 ` [kernel-hardening] " Serge Hallyn
2016-01-23 0:44 ` Serge Hallyn
2016-01-23 0:44 ` [kernel-hardening] " Serge Hallyn
2016-01-23 0:59 ` Ben Hutchings
2016-01-24 20:59 ` Kees Cook
2016-01-24 20:59 ` Kees Cook
2016-01-24 22:20 ` Andy Lutomirski
2016-01-25 18:51 ` Kees Cook
2016-01-22 22:49 ` [PATCH 0/2] " Richard Weinberger
2016-01-22 22:49 ` [kernel-hardening] " Richard Weinberger
2016-01-23 3:02 ` Eric W. Biederman
2016-01-23 3:02 ` [kernel-hardening] " Eric W. Biederman
2016-01-24 20:57 ` Kees Cook
2016-01-24 20:57 ` [kernel-hardening] " Kees Cook
2016-01-26 7:38 ` Serge Hallyn
2016-01-24 22:22 ` Andy Lutomirski
2016-01-24 22:22 ` [kernel-hardening] " Andy Lutomirski
2016-01-25 18:51 ` Kees Cook
2016-01-25 18:51 ` [kernel-hardening] " Kees Cook
2016-01-25 18:53 ` Andy Lutomirski
2016-01-25 18:53 ` [kernel-hardening] " Andy Lutomirski
2016-01-25 18:56 ` Kees Cook
2016-01-25 18:56 ` [kernel-hardening] " Kees Cook
2016-01-25 19:33 ` Eric W. Biederman
2016-01-25 19:33 ` [kernel-hardening] " Eric W. Biederman
2016-01-25 22:34 ` Kees Cook
2016-01-25 22:34 ` [kernel-hardening] " Kees Cook
2016-01-25 23:33 ` Andy Lutomirski
2016-01-25 23:33 ` [kernel-hardening] " Andy Lutomirski
2016-01-26 2:27 ` Daniel Micay
2016-01-26 4:57 ` Eric W. Biederman
2016-01-26 4:57 ` [kernel-hardening] " Eric W. Biederman
2016-01-26 14:38 ` Josh Boyer
2016-01-26 14:38 ` [kernel-hardening] " Josh Boyer
2016-01-26 14:46 ` Austin S. Hemmelgarn
2016-01-26 14:46 ` [kernel-hardening] " Austin S. Hemmelgarn
2016-01-26 14:56 ` Josh Boyer
2016-01-26 14:56 ` [kernel-hardening] " Josh Boyer
2016-01-26 17:20 ` Serge Hallyn
2016-01-26 19:56 ` Josh Boyer
2016-01-26 20:11 ` Austin S. Hemmelgarn
2016-01-26 17:15 ` Serge Hallyn
2016-01-26 18:09 ` Austin S. Hemmelgarn
2016-01-26 18:27 ` Andy Lutomirski
2016-01-26 18:45 ` Austin S. Hemmelgarn
2016-01-26 23:15 ` Kees Cook
2016-01-26 23:13 ` Kees Cook
2016-01-27 10:27 ` Eric W. Biederman
2016-01-27 12:32 ` Austin S. Hemmelgarn
2016-01-28 14:41 ` Robert Święcki
2016-01-28 14:41 ` Robert Święcki
2016-01-26 23:47 ` Josh Boyer
2016-01-26 16:37 ` Kees Cook
2016-01-26 16:37 ` [kernel-hardening] " Kees Cook
2016-01-28 8:56 ` Serge E. Hallyn
2016-01-28 12:53 ` Austin S. Hemmelgarn [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56AA0F62.7090905@gmail.com \
--to=ahferroin7@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=dhowells@redhat.com \
--cc=dvyukov@google.com \
--cc=edumazet@google.com \
--cc=glider@google.com \
--cc=kcc@google.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=mszeredi@suse.cz \
--cc=richard@nod.at \
--cc=robert@swiecki.net \
--cc=sasha.levin@oracle.com \
--cc=serge.hallyn@ubuntu.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.