From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753025Ab2APBJD (ORCPT ); Sun, 15 Jan 2012 20:09:03 -0500 Received: from mail-vx0-f174.google.com ([209.85.220.174]:59870 "EHLO mail-vx0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751859Ab2APBJA convert rfc822-to-8bit (ORCPT ); Sun, 15 Jan 2012 20:09:00 -0500 MIME-Version: 1.0 In-Reply-To: References: From: Andy Lutomirski Date: Sun, 15 Jan 2012 17:08:38 -0800 Message-ID: Subject: Re: [PATCH 4/4] Allow unprivileged chroot when safe To: Linus Torvalds Cc: Casey Schaufler , Jamie Lokier , Will Drewry , linux-kernel@vger.kernel.org, keescook@chromium.org, john.johansen@canonical.com, serge.hallyn@canonical.com, coreyb@linux.vnet.ibm.com, pmoore@redhat.com, eparis@redhat.com, djm@mindrot.org, segoon@openwall.com, rostedt@goodmis.org, jmorris@namei.org, scarybeasts@gmail.com, avi@redhat.com, penberg@cs.helsinki.fi, viro@zeniv.linux.org.uk, mingo@elte.hu, akpm@linux-foundation.org, khilman@ti.com, borislav.petkov@amd.com, amwang@redhat.com, oleg@redhat.com, ak@linux.intel.com, eric.dumazet@gmail.com, gregkh@suse.de, dhowells@redhat.com, daniel.lezcano@free.fr, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, olofj@chromium.org, mhalcrow@google.com, dlaor@redhat.com, corbet@lwn.net, alan@lxorguk.ukuu.org.uk Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, Jan 15, 2012 at 4:45 PM, Linus Torvalds wrote: > On Sun, Jan 15, 2012 at 4:37 PM, Andy Lutomirski wrote: >> Chroot can easily be used to subvert setuid programs.  If no_new_privs, >> then setuid programs don't gain any privilege, so allow chroot. >> >> Because chroot is an easy way to break out of chroot jail, CAP_SYS_ADMIN >> is still required if the caller is already chrooted. > > So I think this whole chroot thing needs more people looking at it. I > brought up chroot as an example, but there may be other reasons why > you don't want user chrooting things than just the setuid confusion. Agreed. There are plenty of security people cc'd. Thoughts (and attacks) are welcome! > > There's also the whole issue with doing things like local non-root > bind mounts, which are arguably more useful than chroot, and which are > disallowed for similar reasons. So I don't think chroot is all that > special. They're almost certainly more useful. Binding the tree of your choice on top of / is a nice (and more secure) way to emulate chroot. The only downside I've thought of in five minutes is that it would prevent the administrator from blocking access to a directory by bind-mounting something on to of it -- an unprivileged non-recursive bind mount of the containing filesystem would get the hidden directory back. I'm not sure this is a real problem. --Andy