From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-fsdevel-owner@vger.kernel.org>
Received: from thejh.net ([37.221.195.125]:54201 "EHLO thejh.net"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1753714AbcJ3TJU (ORCPT <rfc822;linux-fsdevel@vger.kernel.org>);
        Sun, 30 Oct 2016 15:09:20 -0400
Date: Sun, 30 Oct 2016 20:09:15 +0100
From: Jann Horn <jann@thejh.net>
To: Krister Johansen <kjlx@templeofstupid.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>,
        Roland McGrath <roland@hack.frob.com>,
        Oleg Nesterov <oleg@redhat.com>,
        John Johansen <john.johansen@canonical.com>,
        James Morris <james.l.morris@oracle.com>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        Paul Moore <aul@paul-moore.com>,
        Stephen Smalley <sds@tycho.nsa.gov>,
        Eric Paris <eparis@parisplace.org>,
        Casey Schaufler <casey@schaufler-ca.com>,
        Kees Cook <keescook@chromium.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        Janis Danisevskis <jdanis@google.com>,
        Seth Forshee <seth.forshee@canonical.com>,
        "Eric . Biederman" <ebiederm@xmission.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        Benjamin LaHaise <bcrl@kvack.org>,
        Ben Hutchings <ben@decadent.org.uk>,
        Andy Lutomirski <luto@amacapital.net>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        linux-fsdevel@vger.kernel.org,
        linux-security-module@vger.kernel.org, security@kernel.org
Subject: Re: [PATCH v2 8/8] Documentation: add security/ptrace_checks.txt
Message-ID: <20161030190915.GD2558@pc.thejh.net>
References: <1474663238-22134-1-git-send-email-jann@thejh.net>
 <1474663238-22134-9-git-send-email-jann@thejh.net>
 <20161002031600.GC2635@templeofstupid.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
        protocol="application/pgp-signature"; boundary="ZARJHfwaSJQLOEUz"
Content-Disposition: inline
In-Reply-To: <20161002031600.GC2635@templeofstupid.com>
Sender: linux-fsdevel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>


--ZARJHfwaSJQLOEUz
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Oct 01, 2016 at 08:16:00PM -0700, Krister Johansen wrote:
> On Fri, Sep 23, 2016 at 10:40:38PM +0200, Jann Horn wrote:
> > +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> > +FILESYSTEM DEBUG APIS
> > +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> > +
> > +The pid / tgid entries in procfs contain various entries that allow de=
bugging
> > +access to a process. Interesting entries are:
> > +
> > + - auxv permits an ASLR bypass
> > + - cwd can permit bypassing filesystem restrictions in some cases
> > + - environ can leak secret tokens
> > + - fd can permit bypassing filesystem restrictions or leak access to t=
hings like
> > +   pipes
> > + - maps permits an ASLR bypass
> > + - mem grants R+W access to process memory
> > + - stat permits an ASLR bypass
> > +
> > +Of these, all use both a normal filesystem DAC check (where the file o=
wner is
> > +the process owner for a dumpable process, root for a nondumpable proce=
ss) and a
> > +ptrace_may_access() check; however, the DAC check may be modified, and=
 the
> > +ptrace_may_access() is performed under PTRACE_FSCREDS, meaning that in=
stead of
> > +the caller's ruid, rgid and permitted capabilities, the fsuid, fsgid a=
nd
> > +effective capabilities are used, causing the case where a daemon drops=
 its euid
> > +prior to accessing a file for the user to be treated correctly for thi=
s check.
>=20
> Thanks for writing this up.
>=20
> Is it worth mentioning some of the less obvious aspects of how user
> namespaces interact with the filesystem debug APIs?  Of particular note:
> a nondumpable process will always be assigned the global root ids.
> Checks against capabilities for procfs require that the uid and gid have
> a mapping in the current namepsace.   That's enforced through
> capable_wrt_inode_uidgid().

Yeah, makes sense. Added that. Thanks!

--ZARJHfwaSJQLOEUz
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJYFkVbAAoJED4KNFJOeCOofeMQAJfmFd0ZLyJN4cBX1JeaqJQ5
oauiF2NZvbG12LCaTcGqRl1Y0x0Eqz5h+bMex+jBDwloXIaAL/VX82KjHK7RYIxc
1HdsZcm/8diFk0H5glLtTzrITB3HF3yddzBJZIdLr3kic84Lkf5XpxBOiTPLEiSD
x3fU8pE3Z+bnDP8CJwBa7J+/0G+pIc257oypPf7/3mC+NQCojIJMO5DShoVuEv75
e6RU06+bp6m5svWIhhkJXGwQWU6/Q3RQvu5u+3H5KLmn97eTeHC0accx7BDpZsnR
L5Ov4rbkNbV08Irr0viMIW7F5dmkgRLmIGiRZt/LD9X+H5yea5hUQ/UHHfM/unst
hzlctUlS6+AOHZgHJmQhy4VvzbtqhLCo+SdtXjaN7T1HkOqotZHonnOTS287+FX4
M/taTBDO7gnYi/NO8dcV7GKIvv+buVzjY6WFZxktDxQecbzsHJ8lAJmuiAPko7sx
x8V54NYMm2Gm5VQrFMtwndWppbDeimMA0/GP2UdD13CjjsRg87FJb34+PJ9ZMEP9
UaTN7hCPyVs/9TT0zTaVnM/uI0Tk1fZupmxN+OwfHwVaMDjwCw+8G92BWKdWWdsp
SMwtu0sBGVH53Dzna/pOkeaGXk6HOFzIHYJZNzsTQhlErV/HKFZ+KzUsI9ZYW/qt
4LZ6C9omgLA2iQpYFzIR
=PcrR
-----END PGP SIGNATURE-----

--ZARJHfwaSJQLOEUz--