From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756259AbcJNS0s (ORCPT ); Fri, 14 Oct 2016 14:26:48 -0400 Received: from mail-vk0-f50.google.com ([209.85.213.50]:32846 "EHLO mail-vk0-f50.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754339AbcJNS03 (ORCPT ); Fri, 14 Oct 2016 14:26:29 -0400 MIME-Version: 1.0 In-Reply-To: <20161001103728.GM14666@pc.thejh.net> References: <20160930185642.GH14666@pc.thejh.net> <20161001103728.GM14666@pc.thejh.net> From: Andy Lutomirski Date: Fri, 14 Oct 2016 11:25:58 -0700 Message-ID: Subject: Re: [PATCH 1/3] proc: Stop reporting eip and esp in /proc/PID/stat To: Jann Horn Cc: Peter Zijlstra , Andy Lutomirski , X86 ML , "linux-kernel@vger.kernel.org" , Brian Gerst , Borislav Petkov , Linux API , Linus Torvalds , Kees Cook , Tycho Andersen , Tetsuo Handa Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, Oct 1, 2016 at 3:37 AM, Jann Horn wrote: > On Fri, Sep 30, 2016 at 07:01:13PM -0700, Andy Lutomirski wrote: >> On an unrelated note, can we please lock down all the silly historical >> *userspace* info leaks in /proc? Nasty ones include: net, cmdline (at >> the very least, only argv[0] should be visible if the reader lacks >> ptrace access). >> >> Less nasty ones include: limits, sched, autogroup, comm, wchan, >> schedstat, cpuset, cgroup, oom_*, sessionid, coredump_filter > > If that doesn't break stuff, I'm very much in favor of it. > > >> uid_map, gid_map, etc are just screwed up. They should be per >> *namespace* somewhere, and they should require creds on the namespace. > > What do you have in mind? Something like > /proc/namespaces/user:123456/{uid_map,gid_map,setgroups,parent_ns}, > with jumped fake symlinks to the directory and its entries in /proc/$pid/? > Something along those lines would be nice. There's an unfortunate tension between having names for namespaces (like 123456 in your example) for ease of use and *not* having names so CRIU can restore them more easily. > >> timerslack is totally fscked up -- it allows ugo to write and it >> checks the wrong creds. Jann, does your series fix that? > > Nope. Never noticed that thing so far, probably because it was only > added a few months ago. :/ Will add it to my series. -- Andy Lutomirski AMA Capital Management, LLC From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Lutomirski Subject: Re: [PATCH 1/3] proc: Stop reporting eip and esp in /proc/PID/stat Date: Fri, 14 Oct 2016 11:25:58 -0700 Message-ID: References: <20160930185642.GH14666@pc.thejh.net> <20161001103728.GM14666@pc.thejh.net> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Return-path: In-Reply-To: <20161001103728.GM14666-J1fxOzX/cBvk1uMJSBkQmQ@public.gmane.org> Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Jann Horn Cc: Peter Zijlstra , Andy Lutomirski , X86 ML , "linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , Brian Gerst , Borislav Petkov , Linux API , Linus Torvalds , Kees Cook , Tycho Andersen , Tetsuo Handa List-Id: linux-api@vger.kernel.org On Sat, Oct 1, 2016 at 3:37 AM, Jann Horn wrote: > On Fri, Sep 30, 2016 at 07:01:13PM -0700, Andy Lutomirski wrote: >> On an unrelated note, can we please lock down all the silly historical >> *userspace* info leaks in /proc? Nasty ones include: net, cmdline (at >> the very least, only argv[0] should be visible if the reader lacks >> ptrace access). >> >> Less nasty ones include: limits, sched, autogroup, comm, wchan, >> schedstat, cpuset, cgroup, oom_*, sessionid, coredump_filter > > If that doesn't break stuff, I'm very much in favor of it. > > >> uid_map, gid_map, etc are just screwed up. They should be per >> *namespace* somewhere, and they should require creds on the namespace. > > What do you have in mind? Something like > /proc/namespaces/user:123456/{uid_map,gid_map,setgroups,parent_ns}, > with jumped fake symlinks to the directory and its entries in /proc/$pid/? > Something along those lines would be nice. There's an unfortunate tension between having names for namespaces (like 123456 in your example) for ease of use and *not* having names so CRIU can restore them more easily. > >> timerslack is totally fscked up -- it allows ugo to write and it >> checks the wrong creds. Jann, does your series fix that? > > Nope. Never noticed that thing so far, probably because it was only > added a few months ago. :/ Will add it to my series. -- Andy Lutomirski AMA Capital Management, LLC