Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1578862 > unrolled thread

Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field

Started byKees Cook <keescook@chromium.org>
First post2017-02-11 00:50 +0100
Last post2017-02-14 05:20 +0100
Articles 4 — 3 participants

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.


Contents

  Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Kees Cook <keescook@chromium.org> - 2017-02-11 00:50 +0100
    Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Andy Lutomirski <luto@amacapital.net> - 2017-02-13 20:10 +0100
      Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Kees Cook <keescook@chromium.org> - 2017-02-13 20:20 +0100
        Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid=  field Christian Kujau <lists@nerdbynature.de> - 2017-02-14 05:20 +0100

#1578862 — Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field

FromKees Cook <keescook@chromium.org>
Date2017-02-11 00:50 +0100
SubjectRe: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field
Message-ID<t9t6W-1Dv-1@gated-at.bofh.it>
On Wed, Jan 18, 2017 at 3:35 PM, Andy Lutomirski <luto@amacapital.net> wrote:
> On Wed, Jan 18, 2017 at 2:50 PM, Djalal Harouni <tixxdz@gmail.com> wrote:
>> Andy I don't follow here, no_new_privs is never cleared right ? I
>> can't see the corresponding clear bit code for it.
>
> I believe that unsharing userns clears no_new_privs.

Seriously? That's kind of ... weird. I mean, I guess you're
priv-confined in a way, but that seems fragile.

-Kees

-- 
Kees Cook
Pixel Security

[toc] | [next] | [standalone]


#1580001

FromAndy Lutomirski <luto@amacapital.net>
Date2017-02-13 20:10 +0100
Message-ID<tauaC-7Oj-7@gated-at.bofh.it>
In reply to#1578862
On Fri, Feb 10, 2017 at 3:44 PM, Kees Cook <keescook@chromium.org> wrote:
> On Wed, Jan 18, 2017 at 3:35 PM, Andy Lutomirski <luto@amacapital.net> wrote:
>> On Wed, Jan 18, 2017 at 2:50 PM, Djalal Harouni <tixxdz@gmail.com> wrote:
>>> Andy I don't follow here, no_new_privs is never cleared right ? I
>>> can't see the corresponding clear bit code for it.
>>
>> I believe that unsharing userns clears no_new_privs.
>
> Seriously? That's kind of ... weird. I mean, I guess you're
> priv-confined in a way, but that seems fragile.
>

I appear to have made this up.  Either I genuinely pulled it out of
thin air or it was discussed and not done.

$ setpriv --nnp unshare -Ur cat /proc/self/status |grep NoNewPrivs
NoNewPrivs:    1

If it were to be done, it ought to be quite safe except for possible LSM issues.

--Andy

[toc] | [prev] | [next] | [standalone]


#1580028

FromKees Cook <keescook@chromium.org>
Date2017-02-13 20:20 +0100
Message-ID<taukh-7S8-1@gated-at.bofh.it>
In reply to#1580001
On Mon, Feb 13, 2017 at 11:01 AM, Andy Lutomirski <luto@amacapital.net> wrote:
> On Fri, Feb 10, 2017 at 3:44 PM, Kees Cook <keescook@chromium.org> wrote:
>> On Wed, Jan 18, 2017 at 3:35 PM, Andy Lutomirski <luto@amacapital.net> wrote:
>>> On Wed, Jan 18, 2017 at 2:50 PM, Djalal Harouni <tixxdz@gmail.com> wrote:
>>>> Andy I don't follow here, no_new_privs is never cleared right ? I
>>>> can't see the corresponding clear bit code for it.
>>>
>>> I believe that unsharing userns clears no_new_privs.
>>
>> Seriously? That's kind of ... weird. I mean, I guess you're
>> priv-confined in a way, but that seems fragile.
>>
>
> I appear to have made this up.  Either I genuinely pulled it out of
> thin air or it was discussed and not done.
>
> $ setpriv --nnp unshare -Ur cat /proc/self/status |grep NoNewPrivs
> NoNewPrivs:    1
>
> If it were to be done, it ought to be quite safe except for possible LSM issues.

Okay, cool. Thanks. (Also, where does "setpriv" live? I must need a
new set of util-linux or something?)

-Kees

-- 
Kees Cook
Pixel Security

[toc] | [prev] | [next] | [standalone]


#1580288 — Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field

FromChristian Kujau <lists@nerdbynature.de>
Date2017-02-14 05:20 +0100
SubjectRe: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field
Message-ID<taCKR-587-3@gated-at.bofh.it>
In reply to#1580028
On Mon, 13 Feb 2017, Kees Cook wrote:
> Okay, cool. Thanks. (Also, where does "setpriv" live? I must need a
> new set of util-linux or something?)

Indeed, a newer version of util-linux[0] should do, although 
Debian/testing appears to have an extra package just for "setpriv":

  https://packages.debian.org/stretch/setpriv

C.

[0] https://git.kernel.org/cgit/utils/util-linux/util-linux.git/commit/?id=5600c40
-- 
BOFH excuse #65:

system needs to be rebooted

[toc] | [prev] | [standalone]


Back to top | Article view | linux.kernel


csiph-web