Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a process to migrate other tasks between cgroups

From	John Stultz <john.stultz@linaro.org>
Newsgroups	linux.kernel
Subject	Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a process to migrate other tasks between cgroups
Date	2016-12-06 01:30 +0100
Message-ID	<sLbNT-3bh-19@gated-at.bofh.it> (permalink)
References	<sBo01-7H0-1@gated-at.bofh.it> <sBot3-7V7-1@gated-at.bofh.it> <sBoCJ-8eR-5@gated-at.bofh.it> <sBoMp-8k7-3@gated-at.bofh.it> <sGu4N-6a5-17@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Tue, Nov 22, 2016 at 4:57 PM, John Stultz <john.stultz@linaro.org> wrote:
> On Tue, Nov 8, 2016 at 4:12 PM, Andy Lutomirski <luto@amacapital.net> wrote:
>> On Tue, Nov 8, 2016 at 4:03 PM, Alexei Starovoitov
>> <alexei.starovoitov@gmail.com> wrote:
>>> On Tue, Nov 08, 2016 at 03:51:40PM -0800, Andy Lutomirski wrote:
>>>>
>>>> I hate to say it, but I think I may see a problem.  Current
>>>> developments are afoot to make cgroups do more than resource control.
>>>> For example, there's Landlock and there's Daniel's ingress/egress
>>>> filter thing.  Current cgroup controllers can mostly just DoS their
>>>> controlled processes.  These new controllers (or controller-like
>>>> things) can exfiltrate data and change semantics.
>>>>
>>>> Does anyone have a security model in mind for these controllers and
>>>> the cgroups that they're attached to?  I'm reasonably confident that
>>>> CAP_SYS_RESOURCE is not the answer...
>>>
>>> and specifically the answer is... ?
>>> Also would be great if you start with specifying the question first
>>> and the problem you're trying to solve.
>>>
>>
>> I don't have a good answer right now.  Here are some constraints, though:
>>
>> 1. An insufficiently privileged process should not be able to move a
>> victim into a dangerous cgroup.
>>
>> 2. An insufficiently privileged process should not be able to move
>> itself into a dangerous cgroup and then use execve to gain privilege
>> such that the execve'd program can be compromised.
>>
>> 3. An insufficiently privileged process should not be able to make an
>> existing cgroup dangerous in a way that could compromise a victim in
>> that cgroup.
>>
>> 4. An insufficiently privileged process should not be able to make a
>> cgroup dangerous in a way that bypasses protections that would
>> otherwise protect execve() as used by itself or some other process in
>> that cgroup.
>>
>> Keep in mind that "dangerous" may apply to a cgroup's descendents in
>> addition to the cgroup being controlled.
>
> Sorry for taking awhile to get back to you here.  I'm a little
> befuddled as to what next steps I should consider (and honestly, I'm
> not totally sure I really grok your concern here, particularly what
> you mean with "dangrous cgroups").
>
> So is going back to the CAP_CGROUP_MIGRATE approach (to properly
> separate "sufficiently" from "insufficiently privileged") better?
>
> Or something closer to the original method Android used of each cgroup
> having an allow_attach() check which could determine what is
> sufficiently privledged for the respective level of danger the cgroup
> might poise?
>
> Or just stepping back, what method would you imagine to be reasonable
> to allow a specified task to migrate other tasks between cgroups
> without it having to be root/suid?

Any suggested feedback here?

thanks
-john

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups John Stultz <john.stultz@linaro.org> - 2016-12-06 01:30 +0100
  Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Andy Lutomirski <luto@amacapital.net> - 2016-12-06 01:40 +0100
    Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups "Serge E. Hallyn" <serge@hallyn.com> - 2016-12-06 03:10 +0100
      Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Tejun Heo <tj@kernel.org> - 2016-12-06 18:00 +0100
    Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Tejun Heo <tj@kernel.org> - 2016-12-06 18:00 +0100
      Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Andy Lutomirski <luto@amacapital.net> - 2016-12-06 18:10 +0100
        Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Tejun Heo <tj@kernel.org> - 2016-12-06 19:20 +0100
          Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Andy Lutomirski <luto@amacapital.net> - 2016-12-06 19:20 +0100
            Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Tejun Heo <tj@kernel.org> - 2016-12-06 19:30 +0100
              Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups John Stultz <john.stultz@linaro.org> - 2016-12-09 06:40 +0100
                Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Tejun Heo <tj@kernel.org> - 2016-12-09 14:30 +0100

csiph-web