From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75003C4707F for ; Tue, 5 Apr 2022 23:41:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1576564AbiDEXKs (ORCPT ); Tue, 5 Apr 2022 19:10:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54446 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1457556AbiDEQKo (ORCPT ); Tue, 5 Apr 2022 12:10:44 -0400 Received: from smtp-8fab.mail.infomaniak.ch (smtp-8fab.mail.infomaniak.ch [83.166.143.171]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 21F45627C for ; Tue, 5 Apr 2022 09:08:40 -0700 (PDT) Received: from smtp-3-0000.mail.infomaniak.ch (unknown [10.4.36.107]) by smtp-2-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4KXsyH363KzMqGSh; Tue, 5 Apr 2022 18:08:39 +0200 (CEST) Received: from ns3096276.ip-94-23-54.eu (unknown [23.97.221.149]) by smtp-3-0000.mail.infomaniak.ch (Postfix) with ESMTPA id 4KXsyG1HnxzlhFgC; Tue, 5 Apr 2022 18:08:38 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digikod.net; s=20191114; t=1649174919; bh=i3oU7NU7ziCxqF8LgADjo6sEcbpRcshVXFm2U/900+U=; h=Date:To:Cc:References:From:Subject:In-Reply-To:From; b=05hjwZCfXtRlbuAPVKAqLxEozCUGiyJuKeR9DDy+LAIfvTjHN5Dda4CqaT6LR6AGj 0Y+D5L0C62XfZfPHEbOwNOtocUwvCHWgZiSizL41MxkNWkUODtKbPJGli0dLp5ZI0X b0XiDi/o56PGQRzjdvJnsbHhsEcUIwMKSbhe4U14= Message-ID: <7e8d9f8a-f119-6d1a-7861-0493dc513aa7@digikod.net> Date: Tue, 5 Apr 2022 18:09:03 +0200 MIME-Version: 1.0 User-Agent: Content-Language: en-US To: Linus Torvalds , Kees Cook Cc: Al Viro , Andrew Morton , Christian Heimes , Geert Uytterhoeven , James Morris , Luis Chamberlain , Mimi Zohar , Muhammad Usama Anjum , Paul Moore , =?UTF-8?Q?Philippe_Tr=c3=a9buchet?= , Shuah Khan , Steve Dower , Thibaut Sautereau , Vincent Strubel , linux-fsdevel , linux-integrity , Linux Kernel Mailing List , LSM List , Christian Brauner , Theodore Ts'o References: <20220321161557.495388-1-mic@digikod.net> <202204041130.F649632@keescook> <816667d8-2a6c-6334-94a4-6127699d4144@digikod.net> <202204041451.CC4F6BF@keescook> From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= Subject: Re: [GIT PULL] Add trusted_for(2) (was O_MAYEXEC) In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 05/04/2022 01:26, Linus Torvalds wrote: > On Mon, Apr 4, 2022 at 3:25 PM Kees Cook wrote: [...] > >> I think this already exists as AT_EACCESS? It was added with >> faccessat2() itself, if I'm reading the history correctly. > > Yeah, I noticed myself, I just hadn't looked (and I don't do enough > user-space programming to be aware of if that way). I think AT_EACCESS should be usable with the new EXECVE_OK too. > >>> (a) "what about suid bits that user space cannot react to" >> >> What do you mean here? Do you mean setid bits on the file itself? > > Right. > > Maybe we don't care. I think we don't. I think the only corner case that could be different is for files that are executable, SUID and non-readable. In this case it wouldn't matter because userspace could not read the file, which is required for interpretation/execution. Anyway, S[GU]ID bits in scripts are just ignored by execve and we want to follow the same semantic. > > Maybe we do. > > Is the user-space loader going to honor them? Is it going to ignore > them? I don't know. And it actually interacts with things like > 'nosuid', which the kernel does know about, and user space has a hard > time figuring out. > > So if the point is "give me an interface so that I can do the same > thing a kernel execve() loader would do", then those sgid/suid bits > actually may be exactly the kind of thing that user space wants the > kernel to react to - should it ignore them, or should it do something > special when it sees that they are set? > > I'm not saying that they *should* be something we care about. All I'm > saying is that I want that *discussion* to happen. > > Linus