From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756782Ab2AMBME (ORCPT ); Thu, 12 Jan 2012 20:12:04 -0500 Received: from mail-iy0-f174.google.com ([209.85.210.174]:49947 "EHLO mail-iy0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756308Ab2AMBMB convert rfc822-to-8bit (ORCPT ); Thu, 12 Jan 2012 20:12:01 -0500 MIME-Version: 1.0 In-Reply-To: References: <1326411506-16894-1-git-send-email-wad@chromium.org> From: Andrew Lutomirski Date: Thu, 12 Jan 2012 17:11:39 -0800 X-Google-Sender-Auth: QlVFWX2oHwyLQIACWdInGn63DVo Message-ID: Subject: Re: [PATCH PLACEHOLDER 1/3] fs/exec: "always_unprivileged" patch To: Linus Torvalds Cc: Will Drewry , linux-kernel@vger.kernel.org, keescook@chromium.org, john.johansen@canonical.com, serge.hallyn@canonical.com, coreyb@linux.vnet.ibm.com, pmoore@redhat.com, eparis@redhat.com, djm@mindrot.org, segoon@openwall.com, rostedt@goodmis.org, jmorris@namei.org, scarybeasts@gmail.com, avi@redhat.com, penberg@cs.helsinki.fi, viro@zeniv.linux.org.uk, mingo@elte.hu, akpm@linux-foundation.org, khilman@ti.com, borislav.petkov@amd.com, amwang@redhat.com, oleg@redhat.com, ak@linux.intel.com, eric.dumazet@gmail.com, gregkh@suse.de, dhowells@redhat.com, daniel.lezcano@free.fr, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, olofj@chromium.org, mhalcrow@google.com, dlaor@redhat.com, corbet@lwn.net, alan@lxorguk.ukuu.org.uk Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jan 12, 2012 at 4:57 PM, Linus Torvalds wrote: > On Thu, Jan 12, 2012 at 4:42 PM, Andrew Lutomirski wrote: >> >> That may prevent another use: set this new flag, chroot, drop >> privileges, accept network connections.  (The idea being that chroot >> might work unprivileged if this flag is set.) > > Well, if you have privileges, then just do > >   chroot(); >   drop privileges > > and if you depend on the new flag, then you do > >   drop privileges >   set new flag >   chroot > > and if you want to work either way then you just do > >   error = chroot >   drop privileges >   set new flag >   if error >      chroot > > which does the right thing regardless of whether you had privileges > and/or a new kernel or not. > > In any of the three cases I don't see why you'd ever want to drop > privileges *after* setting the new flag. Hmm... What if you're a daemon that needs something like CAP_NET_BIND but also wants to be able to run other helpers without CAP_NET_BIND? (Also, preventing dropping of privileges will probably make a patch more complicted -- I'll have to find and update all the places that allow dropping privileges.) --Andy From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Lutomirski Subject: Re: [PATCH PLACEHOLDER 1/3] fs/exec: "always_unprivileged" patch Date: Thu, 12 Jan 2012 17:11:39 -0800 Message-ID: References: <1326411506-16894-1-git-send-email-wad@chromium.org> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: QUOTED-PRINTABLE Cc: Will Drewry , linux-kernel@vger.kernel.org, keescook@chromium.org, john.johansen@canonical.com, serge.hallyn@canonical.com, coreyb@linux.vnet.ibm.com, pmoore@redhat.com, eparis@redhat.com, djm@mindrot.org, segoon@openwall.com, rostedt@goodmis.org, jmorris@namei.org, scarybeasts@gmail.com, avi@redhat.com, penberg@cs.helsinki.fi, viro@zeniv.linux.org.uk, mingo@elte.hu, akpm@linux-foundation.org, khilman@ti.com, borislav.petkov@amd.com, amwang@redhat.com, oleg@redhat.com, ak@linux.intel.com, eric.dumazet@gmail.com, gregkh@suse.de, dhowells@redhat.com, daniel.lezcano@free.fr, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, olofj@chromium.org, mhalcrow@google.com, dlaor@redhat.com, corbet@lwn.net, alan@lxorguk.ukuu.org.uk To: Linus Torvalds Return-path: In-Reply-To: Sender: linux-security-module-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Thu, Jan 12, 2012 at 4:57 PM, Linus Torvalds wrote: > On Thu, Jan 12, 2012 at 4:42 PM, Andrew Lutomirski wro= te: >> >> That may prevent another use: set this new flag, chroot, drop >> privileges, accept network connections. =A0(The idea being that chro= ot >> might work unprivileged if this flag is set.) > > Well, if you have privileges, then just do > > =A0 chroot(); > =A0 drop privileges > > and if you depend on the new flag, then you do > > =A0 drop privileges > =A0 set new flag > =A0 chroot > > and if you want to work either way then you just do > > =A0 error =3D chroot > =A0 drop privileges > =A0 set new flag > =A0 if error > =A0 =A0 =A0chroot > > which does the right thing regardless of whether you had privileges > and/or a new kernel or not. > > In any of the three cases I don't see why you'd ever want to drop > privileges *after* setting the new flag. Hmm... What if you're a daemon that needs something like CAP_NET_BIND but also wants to be able to run other helpers without CAP_NET_BIND? (Also, preventing dropping of privileges will probably make a patch more complicted -- I'll have to find and update all the places that allow dropping privileges.) --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-securit= y-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html