From: ebiederm@xmission.com (Eric W. Biederman)
To: Oleg Nesterov <oleg@redhat.com>
Cc: Ian Kent <ikent@redhat.com>,
Kernel Mailing List <linux-kernel@vger.kernel.org>,
"J. Bruce Fields" <bfields@fieldses.org>,
Stanislav Kinsbursky <skinsbursky@parallels.com>,
Trond Myklebust <trond.myklebust@primarydata.com>,
David Howells <dhowells@redhat.com>,
Benjamin Coddington <bcodding@redhat.com>,
Al Viro <viro@ZenIV.linux.org.uk>
Subject: Re: [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper
Date: Tue, 25 Nov 2014 16:23:57 -0600 [thread overview]
Message-ID: <87y4qy7wci.fsf@x220.int.ebiederm.org> (raw)
In-Reply-To: <20141125220637.GA10008@redhat.com> (Oleg Nesterov's message of "Tue, 25 Nov 2014 23:06:37 +0100")
Oleg Nesterov <oleg@redhat.com> writes:
> On 11/25, Oleg Nesterov wrote:
>>
>> Let me first apologize, I didn't actually read this series yet.
>>
>> But I have to admit that so far I do not like this approach...
>> probably I am biased.
>
> Yes.
>
> And I have another concern... this is mostly a feeling, I can be
> easily wrong but:
>
>> On 11/25, Ian Kent wrote:
>> >
>> > +static int umh_set_ns(struct subprocess_info *info, struct cred *new)
>> > +{
>> > + struct nsproxy *ns = info->data;
>> > +
>> > + mntns_setfs(ns->mnt_ns);
>>
>> Firstly, it is not clear to me if we should use the caller's ->mnt_ns.
>> Let me remind about the coredump. The dumping task can cloned with
>> CLONE_NEWNS or it cam do unshare(NEWNS)... but OK, I do not understand
>> this enough.
>
> And otoh. If we actually want to use the caller's mnt_ns/namespaces we
> could simply fork/reparent a child which will do execve ?
That would certainly be a better approach, and roughly equivalent to
what exists here. That would even ensure we remain in the proper
cgroups, and lsm context.
The practical problem with the approach presented here is that I can
hijack any user mode helper I wish, and make it run in any executable I
wish as the global root user.
Ian if we were to merge this I believe you would win the award for
easiest path to a root shell.
Eric
next prev parent reply other threads:[~2014-11-25 22:25 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-11-25 1:07 [RFC PATCH 0/4] Namespace contrained helper execution Ian Kent
2014-11-25 1:07 ` [RFC PATCH 1/4] vfs - fs/namespaces.c: break out mntns_setfs() from mntns_install() Ian Kent
2014-11-25 1:07 ` [RFC PATCH 2/4] nsproxy - make create_new_namespaces() non-static Ian Kent
2014-11-25 1:07 ` [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper Ian Kent
2014-11-25 21:52 ` Oleg Nesterov
2014-11-25 22:06 ` Oleg Nesterov
2014-11-25 22:23 ` Eric W. Biederman [this message]
2014-11-25 23:07 ` Ian Kent
2014-11-25 23:19 ` Eric W. Biederman
2014-11-25 23:50 ` Ian Kent
2014-11-26 0:44 ` Ian Kent
2014-11-26 1:38 ` Eric W. Biederman
2014-12-01 21:56 ` Benjamin Coddington
2014-12-02 23:33 ` Ian Kent
2014-12-03 16:49 ` Eric W. Biederman
2014-12-03 18:14 ` Benjamin Coddington
2014-12-03 22:53 ` Ian Kent
2014-12-03 23:34 ` Ian Kent
2014-11-25 23:14 ` Ian Kent
2014-11-26 11:46 ` David Howells
2014-11-26 15:00 ` Eric W. Biederman
2014-11-26 22:57 ` J. Bruce Fields
2014-11-25 22:36 ` Ian Kent
2014-11-25 23:27 ` Eric W. Biederman
2014-11-28 0:19 ` Ian Kent
2014-11-27 1:30 ` Oleg Nesterov
2014-11-25 1:07 ` [RFC PATCH 4/4] KEYS: exec request-key within the requesting task's namespace Ian Kent
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87y4qy7wci.fsf@x220.int.ebiederm.org \
--to=ebiederm@xmission.com \
--cc=bcodding@redhat.com \
--cc=bfields@fieldses.org \
--cc=dhowells@redhat.com \
--cc=ikent@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=oleg@redhat.com \
--cc=skinsbursky@parallels.com \
--cc=trond.myklebust@primarydata.com \
--cc=viro@ZenIV.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).