Re: [PATCH v1] shebang: restrict python interactive prompt/interpreter

From	Mimi Zohar <zohar@linux.vnet.ibm.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH v1] shebang: restrict python interactive prompt/interpreter
Date	2017-06-12 16:30 +0200
Message-ID	<tRyvU-3dT-7@gated-at.bofh.it> (permalink)
References	(3 earlier) <tR9xv-4xT-15@gated-at.bofh.it> <tR9xv-4xT-17@gated-at.bofh.it> <tR9xv-4xT-19@gated-at.bofh.it> <tR9xv-4xT-7@gated-at.bofh.it> <tRnqN-4Ie-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Sun, 2017-06-11 at 22:32 -0400, Mimi Zohar wrote:
> On Sun, 2017-06-11 at 13:44 +0200, Mickaël Salaün wrote:
 
> > Using filesystem xattr seems like a good idea for this kind of
> > exceptions and instead of a hardcoded interpreter path. Something like
> > "security.tpe.interpreter=1|2" (bitmask for interpreter-only and/or CLI)
> > and "security.tpe.environment=HOME,LOGNAME" would be quite flexible to
> > configure a security policy for some binaries. This could also be
> > protected by IMA/EVM, if needed.
> 
> Checking for the existence of an xattr without caching is relatively
> slow.  I'm not sure that we would want to go this route.
 
For identifying interpreters, xattrs would be too slow (without
caching results), but once identified, using xattrs as you suggested,
for specifying how interpreters can be invoked and limiting
environment variables, is a good idea.  Perhaps the two xattrs could
be combined?

Mimi

Thread

Re: [PATCH v1] shebang: restrict python interactive  prompt/interpreter Mickaël Salaün <mic@digikod.net> - 2017-06-11 13:50 +0200
  Re: [PATCH v1] shebang: restrict python interactive  prompt/interpreter Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-06-12 04:40 +0200
    Re: [PATCH v1] shebang: restrict python interactive  prompt/interpreter Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-06-12 16:30 +0200
      Re: [PATCH v1] shebang: restrict python interactive  prompt/interpreter Mickaël Salaün <mic@digikod.net> - 2017-06-13 23:10 +0200
      Re: [PATCH v1] shebang: restrict python interactive  prompt/interpreter Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-06-14 16:20 +0200
        Re: [kernel-hardening] Re: [PATCH v1] shebang: restrict python  interactive prompt/interpreter Boris Lukashev <blukashev@sempervictus.com> - 2017-06-14 22:40 +0200
    Re: [PATCH v1] shebang: restrict python interactive  prompt/interpreter Mickaël Salaün <mic@digikod.net> - 2017-06-13 23:10 +0200
      Re: [kernel-hardening] Re: [PATCH v1] shebang: restrict python  interactive prompt/interpreter Casey Schaufler <casey@schaufler-ca.com> - 2017-06-13 23:50 +0200

csiph-web