From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S945130AbcJSPak (ORCPT ); Wed, 19 Oct 2016 11:30:40 -0400 Received: from mail-vk0-f42.google.com ([209.85.213.42]:34504 "EHLO mail-vk0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S944798AbcJSPaf (ORCPT ); Wed, 19 Oct 2016 11:30:35 -0400 MIME-Version: 1.0 In-Reply-To: <87k2d5nytz.fsf_-_@xmission.com> References: <87twcbq696.fsf@x220.int.ebiederm.org> <20161018135031.GB13117@dhcp22.suse.cz> <8737jt903u.fsf@xmission.com> <20161018150507.GP14666@pc.thejh.net> <87twc9656s.fsf@xmission.com> <20161018191206.GA1210@laptop.thejh.net> <87r37dnz74.fsf@xmission.com> <87k2d5nytz.fsf_-_@xmission.com> From: Andy Lutomirski Date: Wed, 19 Oct 2016 08:30:14 -0700 Message-ID: Subject: Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. To: "Eric W. Biederman" Cc: Jann Horn , Michal Hocko , "linux-kernel@vger.kernel.org" , Linux Containers , Oleg Nesterov , "linux-mm@kvack.org" , Linux FS Devel Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Oct 18, 2016 at 2:15 PM, Eric W. Biederman wrote: > > When the user namespace support was merged the need to prevent > ptracing an executable that is not readable was overlooked. Before getting too excited about this fix, isn't there a much bigger hole that's been there forever? Simply ptrace yourself, exec the program, and then dump the program out. A program that really wants to be unreadable should have a stub: the stub is setuid and readable, but all the stub does is to exec the real program, and the real program should have mode 0500 or similar. ISTM the "right" check would be to enforce that the program's new creds can read the program, but that will break backwards compatibility. --Andy From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: MIME-Version: 1.0 In-Reply-To: <87k2d5nytz.fsf_-_@xmission.com> References: <87twcbq696.fsf@x220.int.ebiederm.org> <20161018135031.GB13117@dhcp22.suse.cz> <8737jt903u.fsf@xmission.com> <20161018150507.GP14666@pc.thejh.net> <87twc9656s.fsf@xmission.com> <20161018191206.GA1210@laptop.thejh.net> <87r37dnz74.fsf@xmission.com> <87k2d5nytz.fsf_-_@xmission.com> From: Andy Lutomirski Date: Wed, 19 Oct 2016 08:30:14 -0700 Message-ID: Subject: Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. To: "Eric W. Biederman" Cc: Jann Horn , Michal Hocko , "linux-kernel@vger.kernel.org" , Linux Containers , Oleg Nesterov , "linux-mm@kvack.org" , Linux FS Devel Content-Type: text/plain; charset=UTF-8 Sender: owner-linux-mm@kvack.org List-ID: On Tue, Oct 18, 2016 at 2:15 PM, Eric W. Biederman wrote: > > When the user namespace support was merged the need to prevent > ptracing an executable that is not readable was overlooked. Before getting too excited about this fix, isn't there a much bigger hole that's been there forever? Simply ptrace yourself, exec the program, and then dump the program out. A program that really wants to be unreadable should have a stub: the stub is setuid and readable, but all the stub does is to exec the real program, and the real program should have mode 0500 or similar. ISTM the "right" check would be to enforce that the program's new creds can read the program, but that will break backwards compatibility. --Andy -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org