Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1665034

Re: [PATCH v4] Introduce v3 namespaced file capabilities

Show all headers | View raw

Hi Stefan,

On Tue, Jun 13, 2017 at 11:47:26AM -0400, Stefan Berger wrote:
> On 05/08/2017 02:11 PM, Serge E. Hallyn wrote:
> > Root in a non-initial user ns cannot be trusted to write a traditional
> > security.capability xattr.  If it were allowed to do so, then any
> > unprivileged user on the host could map his own uid to root in a private
> > namespace, write the xattr, and execute the file with privilege on the
> > host.
> > 
> > However supporting file capabilities in a user namespace is very
> > desirable.  Not doing so means that any programs designed to run with
> > limited privilege must continue to support other methods of gaining and
> > dropping privilege.  For instance a program installer must detect
> > whether file capabilities can be assigned, and assign them if so but set
> > setuid-root otherwise.  The program in turn must know how to drop
> > partial capabilities, and do so only if setuid-root.
> 
> Hi Serge,
> 
> 
>   I have been looking at patch below primarily to learn how we could apply a
> similar technique to security.ima and security.evm for a namespaced IMA.
> From the paragraphs above I thought that you solved the problem of a shared
> filesystem where one now can write different security.capability xattrs by
> effectively supporting for example security.capability[uid=1000] and
> security.capability[uid=2000] written into the filesystem. Each would then
> become visible as security.capability if the userns mapping is set
> appropriately.

One disadvantage of this approach is that whoever is setting up the
container would need to go touch the security.ima attribute for each
file in the contianer, which would slow down container creation time.
For capabilities this makes sense, because you might want the file to
have different capabilities in different namespaces, but for IMA,
since the file hash will be the same in every namespace, it would be
nice to use a design that avoids touching each file on new ns
creation.

Cheers,

Tycho

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: [PATCH v4] Introduce v3 namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-13 17:50 +0200
  Re: [PATCH v4] Introduce v3 namespaced file capabilities Tycho Andersen <tycho@docker.com> - 2017-06-13 19:20 +0200
    Re: [PATCH v4] Introduce v3 namespaced file capabilities James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-06-13 19:50 +0200
      Re: [PATCH v4] Introduce v3 namespaced file capabilities Tycho Andersen <tycho@docker.com> - 2017-06-13 22:50 +0200
        Re: [PATCH v4] Introduce v3 namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-13 22:50 +0200
          Re: [PATCH v4] Introduce v3 namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-13 23:00 +0200
          Re: [PATCH v4] Introduce v3 namespaced file capabilities Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-06-13 23:00 +0200
            Re: [PATCH v4] Introduce v3 namespaced file capabilities Tycho Andersen <tycho@docker.com> - 2017-06-13 23:20 +0200
          Re: [PATCH v4] Introduce v3 namespaced file capabilities Tycho Andersen <tycho@docker.com> - 2017-06-13 23:00 +0200
    Re: [PATCH v4] Introduce v3 namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-13 19:50 +0200
      Re: [PATCH v4] Introduce v3 namespaced file capabilities Tycho Andersen <tycho@docker.com> - 2017-06-13 23:00 +0200
  Re: [PATCH v4] Introduce v3 namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-13 19:20 +0200
    Re: [PATCH v4] Introduce v3 namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-13 20:20 +0200
      Re: [PATCH v4] Introduce v3 namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-14 02:00 +0200
        Re: [PATCH v4] Introduce v3 namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-14 14:50 +0200
          Re: [PATCH v4] Introduce v3 namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-15 05:10 +0200
            Re: [PATCH v4] Introduce v3 namespaced file capabilities Christian Brauner <christian.brauner@mailbox.org> - 2017-06-16 11:10 +0200
            Re: [PATCH v4] Introduce v3 namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-17 00:30 +0200
            Re: [PATCH v4] Introduce v3 namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-17 23:00 +0200
              Re: [PATCH v4] Introduce v3 namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-19 00:20 +0200
                Re: [PATCH v4] Introduce v3 namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-19 03:20 +0200
                Re: [PATCH v4] Introduce v3 namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-19 15:10 +0200
                Re: [PATCH v4] Introduce v3 namespaced file capabilities ebiederm@xmission.com (Eric W. Biederman) - 2017-06-19 23:50 +0200
  Re: [PATCH v4] Introduce v3 namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-14 01:50 +0200
    Re: [PATCH v4] Introduce v3 namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-14 02:00 +0200

csiph-web