Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled

From	Kees Cook <keescook@chromium.org>
Newsgroups	linux.kernel
Subject	Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled
Date	2016-01-27 00:20 +0100
Message-ID	<qVl3Y-2ZP-13@gated-at.bofh.it> (permalink)
References	(6 earlier) <qUVsT-t7-19@gated-at.bofh.it> <qUXXI-2jh-13@gated-at.bofh.it> <qV438-6Ko-7@gated-at.bofh.it> <qVcWM-5sj-49@gated-at.bofh.it> <qVfrz-7iQ-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Tue, Jan 26, 2016 at 9:15 AM, Serge Hallyn <serge.hallyn@ubuntu.com> wrote:
> Quoting Josh Boyer (jwboyer@fedoraproject.org):
>> What you're saying is true for the "oh crap" case of a new userns
>> related CVE being found.  However, there is the case where sysadmins
>> know for a fact that a set of machines should not allow user
>> namespaces to be enabled.  Currently they have 2 choices, 1) use their
>
> Hi - can you give a specific example of this?  (Where users really should
> not be able to use them - not where they might not need them)  I think
> it'll help the discussion tremendously.  Because so far the only good
> arguments I've seen have been about actual bugs in the user namespaces,
> which would not warrant a designed-in permanent disable switch.  If
> there are good use cases where such a disable switch will always be
> needed (and compiling out can't satisfy) that'd be helpful.

My example is a machine in a colo rack serving web pages. A site gets
attacked, and www-data uses user namespaces to continue their attack
to gain root privileges.

The admin of such a machine could have disabled userns months earlier
and limited the scope of the attack.

-Kees

-- 
Kees Cook
Chrome OS & Brillo Security

Thread

[PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled  Kees Cook <keescook@chromium.org> - 2016-01-22 23:40 +0100
  [PATCH 1/2] sysctl: expand use of proc_dointvec_minmax_sysadmin Kees Cook <keescook@chromium.org> - 2016-01-22 23:40 +0100
    Re: [PATCH 1/2] sysctl: expand use of proc_dointvec_minmax_sysadmin ebiederm@xmission.com (Eric W. Biederman) - 2016-01-23 04:30 +0100
      Re: [kernel-hardening] Re: [PATCH 1/2] sysctl: expand use of  proc_dointvec_minmax_sysadmin Jann Horn <jann@thejh.net> - 2016-01-23 23:30 +0100
        Re: [kernel-hardening] Re: [PATCH 1/2] sysctl: expand use of proc_dointvec_minmax_sysadmin ebiederm@xmission.com (Eric W. Biederman) - 2016-01-24 02:40 +0100
          Re: [kernel-hardening] Re: [PATCH 1/2] sysctl: expand use of  proc_dointvec_minmax_sysadmin Al Viro <viro@ZenIV.linux.org.uk> - 2016-01-24 02:50 +0100
            Re: [kernel-hardening] Re: [PATCH 1/2] sysctl: expand use of  proc_dointvec_minmax_sysadmin Jann Horn <jann@thejh.net> - 2016-01-24 03:00 +0100
              Re: [kernel-hardening] Re: [PATCH 1/2] sysctl: expand use of proc_dointvec_minmax_sysadmin ebiederm@xmission.com (Eric W. Biederman) - 2016-01-24 07:20 +0100
                Re: [kernel-hardening] Re: [PATCH 1/2] sysctl: expand use of  proc_dointvec_minmax_sysadmin Jann Horn <jann@thejh.net> - 2016-01-24 07:40 +0100
                Re: [kernel-hardening] Re: [PATCH 1/2] sysctl: expand use of proc_dointvec_minmax_sysadmin ebiederm@xmission.com (Eric W. Biederman) - 2016-01-24 08:00 +0100
  Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Richard Weinberger <richard@nod.at> - 2016-01-22 23:50 +0100
  Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled ebiederm@xmission.com (Eric W. Biederman) - 2016-01-23 04:20 +0100
    Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Kees Cook <keescook@chromium.org> - 2016-01-24 22:00 +0100
      Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER  to be disabled Serge Hallyn <serge.hallyn@ubuntu.com> - 2016-01-26 08:40 +0100
    Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Andy Lutomirski <luto@amacapital.net> - 2016-01-24 23:30 +0100
      Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Kees Cook <keescook@chromium.org> - 2016-01-25 20:00 +0100
        Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled ebiederm@xmission.com (Eric W. Biederman) - 2016-01-25 21:00 +0100
          Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Kees Cook <keescook@chromium.org> - 2016-01-25 23:40 +0100
            Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Andy Lutomirski <luto@amacapital.net> - 2016-01-26 00:40 +0100
            Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER  to be disabled Daniel Micay <danielmicay@gmail.com> - 2016-01-26 03:30 +0100
            Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled ebiederm@xmission.com (Eric W. Biederman) - 2016-01-26 06:10 +0100
              Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Josh Boyer <jwboyer@fedoraproject.org> - 2016-01-26 15:40 +0100
                Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled "Austin S. Hemmelgarn" <ahferroin7@gmail.com> - 2016-01-26 15:50 +0100
                Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Josh Boyer <jwboyer@fedoraproject.org> - 2016-01-26 16:00 +0100
                Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER  to be disabled Serge Hallyn <serge.hallyn@ubuntu.com> - 2016-01-26 18:30 +0100
                Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to  be disabled Josh Boyer <jwboyer@fedoraproject.org> - 2016-01-26 21:00 +0100
                Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to  be disabled "Austin S. Hemmelgarn" <ahferroin7@gmail.com> - 2016-01-26 21:20 +0100
                Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER  to be disabled Serge Hallyn <serge.hallyn@ubuntu.com> - 2016-01-26 18:20 +0100
                Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to  be disabled "Austin S. Hemmelgarn" <ahferroin7@gmail.com> - 2016-01-26 19:20 +0100
                Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to  be disabled Andy Lutomirski <luto@amacapital.net> - 2016-01-26 19:30 +0100
                Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to  be disabled "Austin S. Hemmelgarn" <ahferroin7@gmail.com> - 2016-01-26 19:50 +0100
                Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to  be disabled Kees Cook <keescook@chromium.org> - 2016-01-27 00:20 +0100
                Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to  be disabled Kees Cook <keescook@chromium.org> - 2016-01-27 00:20 +0100
                Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled ebiederm@xmission.com (Eric W. Biederman) - 2016-01-27 11:50 +0100
                Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to  be disabled "Austin S. Hemmelgarn" <ahferroin7@gmail.com> - 2016-01-27 13:40 +0100
              Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Kees Cook <keescook@chromium.org> - 2016-01-26 17:40 +0100
      Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Kees Cook <keescook@chromium.org> - 2016-01-25 20:00 +0100
        Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled Andy Lutomirski <luto@amacapital.net> - 2016-01-25 20:00 +0100

csiph-web