Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1676392

Re: [PATCH 0/3] Enable namespaced file capabilities

From "Serge E. Hallyn" <serge@hallyn.com>
Newsgroups linux.kernel
Subject Re: [PATCH 0/3] Enable namespaced file capabilities
Date 2017-06-28 07:50 +0200
Message-ID <tXe1s-2Mb-11@gated-at.bofh.it> (permalink)
References <tVfEl-nS-3@gated-at.bofh.it> <tVqT8-7uy-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Fri, Jun 23, 2017 at 10:01:46AM +0300, Amir Goldstein wrote:
> On Thu, Jun 22, 2017 at 9:59 PM, Stefan Berger
> <stefanb@linux.vnet.ibm.com> wrote:
> > This series of patches primary goal is to enable file capabilities
> > in user namespaces without affecting the file capabilities that are
> > effective on the host. This is to prevent that any unprivileged user
> > on the host maps his own uid to root in a private namespace, writes
> > the xattr, and executes the file with privilege on the host.
> >
> > We achieve this goal by writing extended attributes with a different
> > name when a user namespace is used. If for example the root user
> > in a user namespace writes the security.capability xattr, the name
> > of the xattr that is actually written is encoded as
> > security.capability@uid=1000 for root mapped to uid 1000 on the host.
> > When listing the xattrs on the host, the existing security.capability
> > as well as the security.capability@uid=1000 will be shown. Inside the
> > namespace only 'security.capability', with the value of
> > security.capability@uid=1000, is visible.
> >
> 
> Am I the only one who thinks that suffix is perhaps not the best grammar
> to use for this namespace?
> xattrs are clearly namespaced by prefix, so it seems right to me to keep
> it that way - define a new special xattr namespace "ns" and only if that
> prefix exists, the @uid suffix will be parsed.
> This could be either  ns.security.capability@uid=1000 or
> ns@uid=1000.security.capability. The latter seems more correct to me,
> because then we will be able to namespace any xattr without having to
> protect from "unprivileged xattr injection", i.e.:
> setfattr -n "user.whatever.foo@uid=0"
> 
> Amir.

Hi Amir,

I was liking the prefix at first, but I'm actually not sure it's worth
it.  THe main advantage would be so that checking for namespace or other
tags could be done always at the same offset simplifying the parser.
But since we will want to only handle namespacing for some tags, and
potentially differently for each task, it won't actually be simpler, I
don't think.

On the other hand we do want to make sure that the syntax we use is
generally usable, so I think simply specifying that >1 tags can each
be separate by '@' should suffice.  So for now we'd only have

	security.capability@uid=100000

soon we'd hopefully have

	security.ima@uid=100000

and eventually trusted.blarb@foo=bar

-serge

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/3] Enable namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-22 21:10 +0200
  [PATCH 1/3] xattr: Enable security.capability in user namespaces Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-22 21:10 +0200
    [PATCH] xattr: fix kstrdup.cocci warnings kbuild test robot <lkp@intel.com> - 2017-06-24 23:10 +0200
    Re: [PATCH 1/3] xattr: Enable security.capability in user namespaces kbuild test robot <lkp@intel.com> - 2017-06-24 23:10 +0200
  Re: [PATCH 0/3] Enable namespaced file capabilities Casey Schaufler <casey@schaufler-ca.com> - 2017-06-22 22:00 +0200
    Re: [PATCH 0/3] Enable namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-22 22:20 +0200
      Re: [PATCH 0/3] Enable namespaced file capabilities Casey Schaufler <casey@schaufler-ca.com> - 2017-06-22 22:40 +0200
        Re: [PATCH 0/3] Enable namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-22 23:10 +0200
        Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-22 23:10 +0200
          Re: [PATCH 0/3] Enable namespaced file capabilities Casey Schaufler <casey@schaufler-ca.com> - 2017-06-23 00:50 +0200
            Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 01:10 +0200
  Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 01:40 +0200
    Re: [PATCH 0/3] Enable namespaced file capabilities James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-06-23 02:20 +0200
      Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 03:30 +0200
      Re: [PATCH 0/3] Enable namespaced file capabilities ebiederm@xmission.com (Eric W. Biederman) - 2017-06-23 19:50 +0200
        Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 20:40 +0200
  Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 01:40 +0200
  Re: [PATCH 0/3] Enable namespaced file capabilities James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-06-23 01:40 +0200
  Re: [PATCH 0/3] Enable namespaced file capabilities Amir Goldstein <amir73il@gmail.com> - 2017-06-23 09:10 +0200
    Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 18:10 +0200
      Re: [PATCH 0/3] Enable namespaced file capabilities Casey Schaufler <casey@schaufler-ca.com> - 2017-06-23 18:20 +0200
        Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 18:40 +0200
          Re: [PATCH 0/3] Enable namespaced file capabilities Casey Schaufler <casey@schaufler-ca.com> - 2017-06-23 19:00 +0200
            Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 19:10 +0200
              Re: [PATCH 0/3] Enable namespaced file capabilities ebiederm@xmission.com (Eric W. Biederman) - 2017-06-23 20:00 +0200
                Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 20:40 +0200
          Re: [PATCH 0/3] Enable namespaced file capabilities James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-06-23 19:10 +0200
            Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 19:30 +0200
            Re: [PATCH 0/3] Enable namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-23 19:40 +0200
              Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 20:40 +0200
        Re: [PATCH 0/3] Enable namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-23 20:10 +0200
          Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 20:40 +0200
            Re: [PATCH 0/3] Enable namespaced file capabilities Casey Schaufler <casey@schaufler-ca.com> - 2017-06-23 22:40 +0200
            Re: [PATCH 0/3] Enable namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-24 01:10 +0200
              Re: [PATCH 0/3] Enable namespaced file capabilities Casey Schaufler <casey@schaufler-ca.com> - 2017-06-24 02:00 +0200
    Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-28 07:50 +0200
      Re: [PATCH 0/3] Enable namespaced file capabilities Amir Goldstein <amir73il@gmail.com> - 2017-06-28 09:20 +0200
        Re: [PATCH 0/3] Enable namespaced file capabilities Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-06-28 16:10 +0200
        Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-28 16:30 +0200
  Re: [PATCH 0/3] Enable namespaced file capabilities Vivek Goyal <vgoyal@redhat.com> - 2017-06-23 22:20 +0200
    Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 22:20 +0200
      Re: [PATCH 0/3] Enable namespaced file capabilities Vivek Goyal <vgoyal@redhat.com> - 2017-06-23 22:40 +0200
        Re: [PATCH 0/3] Enable namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-23 23:00 +0200

csiph-web