From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Lutomirski Subject: Re: [REVIEW][PATCH 1/2] userns: Better restrictions on when proc and sysfs can be mounted Date: Tue, 3 Sep 2013 10:40:36 -0700 Message-ID: References: <878uzmhkqg.fsf@xmission.com> <87a9k2g5la.fsf@xmission.com> <87eh99noa0.fsf@xmission.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: Linux FS Devel , Linux Containers , "linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" To: "Eric W. Biederman" Return-path: In-Reply-To: <87eh99noa0.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org List-Id: linux-fsdevel.vger.kernel.org On Sat, Aug 31, 2013 at 9:45 PM, Eric W. Biederman wrote: > ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) writes: > >> Andy Lutomirski writes: >> >>> On Tue, Aug 27, 2013 at 2:44 PM, Eric W. Biederman >>> wrote: >>>> >>>> Rely on the fact that another flavor of the filesystem is already >>>> mounted and do not rely on state in the user namespace. >>> >>> Possibly dumb question: does this check whether the pre-existing mount >>> has hidepid set? >> >> Not currently. >> >> It may be worth doing something with respect to hidepid. I forget what >> hidepid tries to do, and I need to dash. But feel free to cook up a >> follow on patch. > > So I have thought about this a bit more. > > hidepid hides the processes that ptrace_may_access will fail on. > > You can only reach the point where an unprivileged mount of a pid > namespace is possible if you have created both a user namespace and a > pid namespace. Which means the creator of the pid namespace will be > capable of ptracing all of the other processes in the pid namespace > (ignoring setns). > > So I don't see a point of worry about hidepid or the hidepid gid on > child pid namespaces. The cases it is attempting to protecting against > really don't exist. Fair enough. I didn't realize that you had to own the pid namespace. --Andy