Re: [PATCH v1] shebang: restrict python interactive prompt/interpreter

From	Alan Cox <gnomes@lxorguk.ukuu.org.uk>
Newsgroups	linux.kernel
Subject	Re: [PATCH v1] shebang: restrict python interactive prompt/interpreter
Date	2017-06-14 16:20 +0200
Message-ID	<tShjj-6eD-7@gated-at.bofh.it> (permalink)
References	(4 earlier) <tR9xv-4xT-17@gated-at.bofh.it> <tR9xv-4xT-19@gated-at.bofh.it> <tR9xv-4xT-7@gated-at.bofh.it> <tRnqN-4Ie-3@gated-at.bofh.it> <tRyvU-3dT-7@gated-at.bofh.it>
Organization	Intel Corporation

Show all headers | View raw

On Mon, 12 Jun 2017 10:27:24 -0400
Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> On Sun, 2017-06-11 at 22:32 -0400, Mimi Zohar wrote:
> > On Sun, 2017-06-11 at 13:44 +0200, Mickaël Salaün wrote:  
>  
> > > Using filesystem xattr seems like a good idea for this kind of
> > > exceptions and instead of a hardcoded interpreter path. Something like
> > > "security.tpe.interpreter=1|2" (bitmask for interpreter-only and/or CLI)
> > > and "security.tpe.environment=HOME,LOGNAME" would be quite flexible to
> > > configure a security policy for some binaries. This could also be
> > > protected by IMA/EVM, if needed.  
> > 
> > Checking for the existence of an xattr without caching is relatively
> > slow.  I'm not sure that we would want to go this route.  
>  
> For identifying interpreters, xattrs would be too slow (without
> caching results), but once identified, using xattrs as you suggested,
> for specifying how interpreters can be invoked and limiting
> environment variables, is a good idea.  Perhaps the two xattrs could
> be combined?

It's not just #! you need to cover. If I can run ld.so for my arch format
then ld.so will helpfully let me load any ELF binary I like and run it.

Alan

Thread

Re: [PATCH v1] shebang: restrict python interactive  prompt/interpreter Mickaël Salaün <mic@digikod.net> - 2017-06-11 13:50 +0200
  Re: [PATCH v1] shebang: restrict python interactive  prompt/interpreter Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-06-12 04:40 +0200
    Re: [PATCH v1] shebang: restrict python interactive  prompt/interpreter Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-06-12 16:30 +0200
      Re: [PATCH v1] shebang: restrict python interactive  prompt/interpreter Mickaël Salaün <mic@digikod.net> - 2017-06-13 23:10 +0200
      Re: [PATCH v1] shebang: restrict python interactive  prompt/interpreter Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-06-14 16:20 +0200
        Re: [kernel-hardening] Re: [PATCH v1] shebang: restrict python  interactive prompt/interpreter Boris Lukashev <blukashev@sempervictus.com> - 2017-06-14 22:40 +0200
    Re: [PATCH v1] shebang: restrict python interactive  prompt/interpreter Mickaël Salaün <mic@digikod.net> - 2017-06-13 23:10 +0200
      Re: [kernel-hardening] Re: [PATCH v1] shebang: restrict python  interactive prompt/interpreter Casey Schaufler <casey@schaufler-ca.com> - 2017-06-13 23:50 +0200

csiph-web