Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction

From	Djalal Harouni <tixxdz@gmail.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction
Date	2017-04-24 16:30 +0200
Message-ID	<tzNa3-87g-55@gated-at.bofh.it> (permalink)
References	(7 earlier) <tyQtk-3Gv-5@gated-at.bofh.it> <tyQD0-3JK-3@gated-at.bofh.it> <tyQWl-45g-7@gated-at.bofh.it> <tyXbr-7Ul-3@gated-at.bofh.it> <tz8Tg-6PP-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Sat, Apr 22, 2017 at 9:29 PM, Kees Cook <keescook@chromium.org> wrote:
> On Fri, Apr 21, 2017 at 11:51 PM, Andy Lutomirski <luto@kernel.org> wrote:
>> On Fri, Apr 21, 2017 at 5:12 PM, Djalal Harouni <tixxdz@gmail.com> wrote:
>>> On Sat, Apr 22, 2017 at 1:51 AM, Andy Lutomirski <luto@kernel.org> wrote:
>>>
[...]
>>> * DCCP use after free CVE-2017-6074
>>> * n_hldc CVE-2017-2636
>>> * XFRM framework CVE-2017-7184
>>> * L2TPv3 CVE-2016-10200
>>>
>>> Most of these need CAP_NET_ADMIN to be autoloaded, however we also
>>> need CAP_NET_ADMIN for other things... therefore it is better to have
>>> an extra facility that could coexist with CAP_NET_ADMIN and other
>>> sandbox features.
>>>
>>
>> I agree that the feature is important, but I think your implementation
>> is needlessly dangerous.  I imagine that the main uses that you care
>> about involve containers.  How about doing it in a safer way that
>> works for containers?  I can think of a few.  For example:
>>
>> 1. A sysctl that, if set, prevents autoloading outside the root
>> userns.  This isn't very flexible at all, but it might work.
>>
>> 2. Your patch, but require privilege within the calling namespace to
>> set the prctl.
>
> How about CAP_SYS_ADMIN || no_new_privs?
>
> -Kees
>

Yes I can update as per Andy suggestion to require privileges inside
the calling namespace to set prctl. Other options that are not prctl
based have more variants, that make them hard to use.

So I would got with CAP_SYS_ADMIN in the calling userns ||
no_new_privs , I would have said CAP_SYS_MODULE in the userns but it
seems better to standardize on CAP_SYS_ADMIN to set the prctl.

-- 
tixxdz

Thread

[PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-20 00:30 +0200
  Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-20 00:40 +0200
  Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-20 01:20 +0200
    Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-20 01:50 +0200
      Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-20 04:50 +0200
        Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-22 01:20 +0200
          Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@amacapital.net> - 2017-04-22 01:30 +0200
            Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-22 01:50 +0200
              Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-22 02:00 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-22 02:20 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-22 03:30 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-22 09:00 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-22 21:30 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-24 16:30 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Kees Cook <keescook@chromium.org> - 2017-04-24 20:10 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-24 20:40 +0200
            Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Casey Schaufler <casey@schaufler-ca.com> - 2017-04-22 02:00 +0200
              Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-04-22 02:10 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Casey Schaufler <casey@schaufler-ca.com> - 2017-04-22 02:20 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@amacapital.net> - 2017-04-22 08:50 +0200
            Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-22 14:20 +0200
              Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-05-04 15:10 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction "Serge E. Hallyn" <serge@hallyn.com> - 2017-05-04 17:00 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-05-05 15:10 +0200
                Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Andy Lutomirski <luto@kernel.org> - 2017-05-05 18:20 +0200
  Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction Rusty Russell <rusty@rustcorp.com.au> - 2017-04-24 06:40 +0200
    Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-26 11:30 +0200
      Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules autoload restriction Rusty Russell <rusty@rustcorp.com.au> - 2017-04-27 05:20 +0200
        Re: [PATCH v3 2/2] modules:capabilities: add a per-task modules  autoload restriction Djalal Harouni <tixxdz@gmail.com> - 2017-04-27 15:20 +0200

csiph-web