From: ebiederm@xmission.com (Eric W. Biederman)
To: Alexey Gladkov <gladkov.alexey@gmail.com>
Cc: Jann Horn <jannh@google.com>, Kees Cook <keescook@chromium.org>,
Andy Lutomirski <luto@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
linux-fsdevel@vger.kernel.org,
kernel list <linux-kernel@vger.kernel.org>,
Kernel Hardening <kernel-hardening@lists.openwall.com>,
linux-security-module <linux-security-module@vger.kernel.org>,
Linux API <linux-api@vger.kernel.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Akinobu Mita <akinobu.mita@gmail.com>,
Oleg Nesterov <oleg@redhat.com>,
Jeff Layton <jlayton@poochiereds.net>,
Ingo Molnar <mingo@kernel.org>,
Alexey Dobriyan <adobriyan@gmail.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
aniel Micay <danielmicay@gmail.com>,
Jonathan Corbet <corbet@lwn.net>,
bfields@fieldses.org, Stephen Rothwell <sfr@canb.auug.org.au>,
Solar Designer <solar@openwall.com>,
"Dmitry V. Levin" <ldv@altlinux.org>,
Djalal Harouni <tixxdz@gmail.com>
Subject: Re: [PATCH v5 7/7] proc: add option to mount only a pids subset
Date: Mon, 14 May 2018 08:13:50 -0500 [thread overview]
Message-ID: <874ljamlbl.fsf@xmission.com> (raw)
In-Reply-To: <20180514090117.GC28179@comp-core-i7-2640m-0182e6> (Alexey Gladkov's message of "Mon, 14 May 2018 11:01:17 +0200")
Alexey Gladkov <gladkov.alexey@gmail.com> writes:
> On Fri, May 11, 2018 at 03:58:39PM +0200, Jann Horn wrote:
>> On Fri, May 11, 2018 at 11:37 AM, Alexey Gladkov
>> <gladkov.alexey@gmail.com> wrote:
>> > This allows to hide all files and directories in the procfs that are not
>> > related to tasks.
>>
>> /proc/$pid/net and /proc/$pid/task/$tid/net aren't in scope for this
>> protection, even though they contain information about the whole
>> network namespace of the task, right?
>
> Yes. The pidonly makes visible only pids subset. You can still access the
> process namespaces via /proc/$pid/ns.
>
> We can think of additional constraints since the parameters are not
> stored in the pid namespace anymore.
pidonly is fine.
You have to be very careful with this. The existing hidepid option
needs to live in the pid namespace. The issue is if someone is allowed
to mount proc and play with these options as in remount you this may
cause issues.
Eric
prev parent reply other threads:[~2018-05-14 13:14 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-05-11 9:37 [PATCH v5 7/7] proc: add option to mount only a pids subset Alexey Gladkov
2018-05-11 13:58 ` Jann Horn
2018-05-14 9:01 ` Alexey Gladkov
2018-05-14 13:13 ` Eric W. Biederman [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=874ljamlbl.fsf@xmission.com \
--to=ebiederm@xmission.com \
--cc=adobriyan@gmail.com \
--cc=akinobu.mita@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=bfields@fieldses.org \
--cc=corbet@lwn.net \
--cc=danielmicay@gmail.com \
--cc=gladkov.alexey@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=jannh@google.com \
--cc=jlayton@poochiereds.net \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=ldv@altlinux.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@kernel.org \
--cc=oleg@redhat.com \
--cc=sfr@canb.auug.org.au \
--cc=solar@openwall.com \
--cc=tixxdz@gmail.com \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).