Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1450525 > unrolled thread
| Started by | "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> |
|---|---|
| First post | 2016-07-26 12:40 +0200 |
| Last post | 2016-07-26 22:50 +0200 |
| Articles | 5 — 3 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: [PATCH v2 00/10] userns: sysctl limits for namespaces "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-07-26 12:40 +0200
Re: [PATCH v2 00/10] userns: sysctl limits for namespaces ebiederm@xmission.com (Eric W. Biederman) - 2016-07-26 17:30 +0200
Re: [PATCH v2 00/10] userns: sysctl limits for namespaces Kees Cook <keescook@chromium.org> - 2016-07-26 19:00 +0200
Re: [PATCH v2 00/10] userns: sysctl limits for namespaces "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-07-26 19:30 +0200
Re: [PATCH v2 00/10] userns: sysctl limits for namespaces Kees Cook <keescook@chromium.org> - 2016-07-26 22:50 +0200
| From | "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> |
|---|---|
| Date | 2016-07-26 12:40 +0200 |
| Subject | Re: [PATCH v2 00/10] userns: sysctl limits for namespaces |
| Message-ID | <rZ7Wh-Od-23@gated-at.bofh.it> |
Hello Eric, I realized I had a question after the last mail. On 07/21/2016 06:39 PM, Eric W. Biederman wrote: > > This patchset addresses two use cases: > - Implement a sane upper bound on the number of namespaces. > - Provide a way for sandboxes to limit the attack surface from > namespaces. Can you say more about the second point? What exactly is the problem that is being addressed, and how does the patch series address it? (It would be good to have those details in the revised commit message...) Cheers, Michael
[toc] | [next] | [standalone]
| From | ebiederm@xmission.com (Eric W. Biederman) |
|---|---|
| Date | 2016-07-26 17:30 +0200 |
| Message-ID | <rZcsW-3C5-11@gated-at.bofh.it> |
| In reply to | #1450525 |
"Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> writes: > Hello Eric, > > I realized I had a question after the last mail. > > On 07/21/2016 06:39 PM, Eric W. Biederman wrote: >> >> This patchset addresses two use cases: >> - Implement a sane upper bound on the number of namespaces. >> - Provide a way for sandboxes to limit the attack surface from >> namespaces. > > Can you say more about the second point? What exactly is the > problem that is being addressed, and how does the patch series > address it? (It would be good to have those details in the > revised commit message...) At some point it was reported that seccomp was not sufficient to disable namespace creation. I need to go back and look at that claim to see which set of circumstances that was referring to. Seccomp doesn't stack so I can see why it is an issue. The general problem is that namespaces by their nature (and especially in combination with the user namespaces) allow unprivileged users to use more of the kernel than a user would have access to without them. This in turn allows malicious users more kernel calls they can use in attempt to find an exploitable bug. So if you are building a sandbox/chroot jail/chromium tab or anything like that and you know you won't be needing a kernel feature having an easy way to disable the feature is useful for making the kernel marginally more secure, as certain attack vectors are no longer possible. Eric
[toc] | [prev] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2016-07-26 19:00 +0200 |
| Message-ID | <rZdS2-4t5-21@gated-at.bofh.it> |
| In reply to | #1450649 |
On Tue, Jul 26, 2016 at 8:06 AM, Eric W. Biederman <ebiederm@xmission.com> wrote: > "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> writes: > >> Hello Eric, >> >> I realized I had a question after the last mail. >> >> On 07/21/2016 06:39 PM, Eric W. Biederman wrote: >>> >>> This patchset addresses two use cases: >>> - Implement a sane upper bound on the number of namespaces. >>> - Provide a way for sandboxes to limit the attack surface from >>> namespaces. >> >> Can you say more about the second point? What exactly is the >> problem that is being addressed, and how does the patch series >> address it? (It would be good to have those details in the >> revised commit message...) > > At some point it was reported that seccomp was not sufficient to disable > namespace creation. I need to go back and look at that claim to see > which set of circumstances that was referring to. Seccomp doesn't stack > so I can see why it is an issue. seccomp does stack. The trouble usually comes from a perception that seccomp overhead is not trivial, so setting a system-wide policy is a bit of a large hammer for such a limitiation. Also, at the time, seccomp could be bypasses with ptrace, but this (as of v4.8) is no longer true. > The general problem is that namespaces by their nature (and especially > in combination with the user namespaces) allow unprivileged users to use > more of the kernel than a user would have access to without them. This > in turn allows malicious users more kernel calls they can use in attempt > to find an exploitable bug. > > So if you are building a sandbox/chroot jail/chromium tab or anything > like that and you know you won't be needing a kernel feature having an > easy way to disable the feature is useful for making the kernel > marginally more secure, as certain attack vectors are no longer > possible. -Kees -- Kees Cook Chrome OS & Brillo Security
[toc] | [prev] | [next] | [standalone]
| From | "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> |
|---|---|
| Date | 2016-07-26 19:30 +0200 |
| Message-ID | <rZel3-4VT-3@gated-at.bofh.it> |
| In reply to | #1450688 |
On 26 July 2016 at 18:52, Kees Cook <keescook@chromium.org> wrote: > On Tue, Jul 26, 2016 at 8:06 AM, Eric W. Biederman > <ebiederm@xmission.com> wrote: >> "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> writes: >> >>> Hello Eric, >>> >>> I realized I had a question after the last mail. >>> >>> On 07/21/2016 06:39 PM, Eric W. Biederman wrote: >>>> >>>> This patchset addresses two use cases: >>>> - Implement a sane upper bound on the number of namespaces. >>>> - Provide a way for sandboxes to limit the attack surface from >>>> namespaces. >>> >>> Can you say more about the second point? What exactly is the >>> problem that is being addressed, and how does the patch series >>> address it? (It would be good to have those details in the >>> revised commit message...) >> >> At some point it was reported that seccomp was not sufficient to disable >> namespace creation. I need to go back and look at that claim to see >> which set of circumstances that was referring to. Seccomp doesn't stack >> so I can see why it is an issue. > > seccomp does stack. The trouble usually comes from a perception that > seccomp overhead is not trivial, so setting a system-wide policy is a > bit of a large hammer for such a limitiation. Also, at the time, > seccomp could be bypasses with ptrace, but this (as of v4.8) is no > longer true. Sounds like someone needs to send me a patch for the seccomp.2 man page? Cheers, Michael -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/
[toc] | [prev] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2016-07-26 22:50 +0200 |
| Message-ID | <rZhsC-6N1-15@gated-at.bofh.it> |
| In reply to | #1450705 |
On Tue, Jul 26, 2016 at 10:29 AM, Michael Kerrisk (man-pages) <mtk.manpages@gmail.com> wrote: > On 26 July 2016 at 18:52, Kees Cook <keescook@chromium.org> wrote: >> On Tue, Jul 26, 2016 at 8:06 AM, Eric W. Biederman >> <ebiederm@xmission.com> wrote: >>> "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> writes: >>> >>>> Hello Eric, >>>> >>>> I realized I had a question after the last mail. >>>> >>>> On 07/21/2016 06:39 PM, Eric W. Biederman wrote: >>>>> >>>>> This patchset addresses two use cases: >>>>> - Implement a sane upper bound on the number of namespaces. >>>>> - Provide a way for sandboxes to limit the attack surface from >>>>> namespaces. >>>> >>>> Can you say more about the second point? What exactly is the >>>> problem that is being addressed, and how does the patch series >>>> address it? (It would be good to have those details in the >>>> revised commit message...) >>> >>> At some point it was reported that seccomp was not sufficient to disable >>> namespace creation. I need to go back and look at that claim to see >>> which set of circumstances that was referring to. Seccomp doesn't stack >>> so I can see why it is an issue. >> >> seccomp does stack. The trouble usually comes from a perception that >> seccomp overhead is not trivial, so setting a system-wide policy is a >> bit of a large hammer for such a limitiation. Also, at the time, >> seccomp could be bypasses with ptrace, but this (as of v4.8) is no >> longer true. > > Sounds like someone needs to send me a patch for the seccomp.2 man page? It's on my TODO list, no worries. :) I'm waiting for it to land in Linus's tree first. It's only been in -next so far. -Kees -- Kees Cook Chrome OS & Brillo Security
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web