Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1578862 > unrolled thread
| Started by | Kees Cook <keescook@chromium.org> |
|---|---|
| First post | 2017-02-11 00:50 +0100 |
| Last post | 2017-02-14 05:20 +0100 |
| Articles | 4 — 3 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field Kees Cook <keescook@chromium.org> - 2017-02-11 00:50 +0100
Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field Andy Lutomirski <luto@amacapital.net> - 2017-02-13 20:10 +0100
Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field Kees Cook <keescook@chromium.org> - 2017-02-13 20:20 +0100
Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field Christian Kujau <lists@nerdbynature.de> - 2017-02-14 05:20 +0100
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2017-02-11 00:50 +0100 |
| Subject | Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field |
| Message-ID | <t9t6W-1Dv-1@gated-at.bofh.it> |
On Wed, Jan 18, 2017 at 3:35 PM, Andy Lutomirski <luto@amacapital.net> wrote: > On Wed, Jan 18, 2017 at 2:50 PM, Djalal Harouni <tixxdz@gmail.com> wrote: >> Andy I don't follow here, no_new_privs is never cleared right ? I >> can't see the corresponding clear bit code for it. > > I believe that unsharing userns clears no_new_privs. Seriously? That's kind of ... weird. I mean, I guess you're priv-confined in a way, but that seems fragile. -Kees -- Kees Cook Pixel Security
[toc] | [next] | [standalone]
| From | Andy Lutomirski <luto@amacapital.net> |
|---|---|
| Date | 2017-02-13 20:10 +0100 |
| Message-ID | <tauaC-7Oj-7@gated-at.bofh.it> |
| In reply to | #1578862 |
On Fri, Feb 10, 2017 at 3:44 PM, Kees Cook <keescook@chromium.org> wrote: > On Wed, Jan 18, 2017 at 3:35 PM, Andy Lutomirski <luto@amacapital.net> wrote: >> On Wed, Jan 18, 2017 at 2:50 PM, Djalal Harouni <tixxdz@gmail.com> wrote: >>> Andy I don't follow here, no_new_privs is never cleared right ? I >>> can't see the corresponding clear bit code for it. >> >> I believe that unsharing userns clears no_new_privs. > > Seriously? That's kind of ... weird. I mean, I guess you're > priv-confined in a way, but that seems fragile. > I appear to have made this up. Either I genuinely pulled it out of thin air or it was discussed and not done. $ setpriv --nnp unshare -Ur cat /proc/self/status |grep NoNewPrivs NoNewPrivs: 1 If it were to be done, it ought to be quite safe except for possible LSM issues. --Andy
[toc] | [prev] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2017-02-13 20:20 +0100 |
| Message-ID | <taukh-7S8-1@gated-at.bofh.it> |
| In reply to | #1580001 |
On Mon, Feb 13, 2017 at 11:01 AM, Andy Lutomirski <luto@amacapital.net> wrote: > On Fri, Feb 10, 2017 at 3:44 PM, Kees Cook <keescook@chromium.org> wrote: >> On Wed, Jan 18, 2017 at 3:35 PM, Andy Lutomirski <luto@amacapital.net> wrote: >>> On Wed, Jan 18, 2017 at 2:50 PM, Djalal Harouni <tixxdz@gmail.com> wrote: >>>> Andy I don't follow here, no_new_privs is never cleared right ? I >>>> can't see the corresponding clear bit code for it. >>> >>> I believe that unsharing userns clears no_new_privs. >> >> Seriously? That's kind of ... weird. I mean, I guess you're >> priv-confined in a way, but that seems fragile. >> > > I appear to have made this up. Either I genuinely pulled it out of > thin air or it was discussed and not done. > > $ setpriv --nnp unshare -Ur cat /proc/self/status |grep NoNewPrivs > NoNewPrivs: 1 > > If it were to be done, it ought to be quite safe except for possible LSM issues. Okay, cool. Thanks. (Also, where does "setpriv" live? I must need a new set of util-linux or something?) -Kees -- Kees Cook Pixel Security
[toc] | [prev] | [next] | [standalone]
| From | Christian Kujau <lists@nerdbynature.de> |
|---|---|
| Date | 2017-02-14 05:20 +0100 |
| Subject | Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field |
| Message-ID | <taCKR-587-3@gated-at.bofh.it> |
| In reply to | #1580028 |
On Mon, 13 Feb 2017, Kees Cook wrote: > Okay, cool. Thanks. (Also, where does "setpriv" live? I must need a > new set of util-linux or something?) Indeed, a newer version of util-linux[0] should do, although Debian/testing appears to have an extra package just for "setpriv": https://packages.debian.org/stretch/setpriv C. [0] https://git.kernel.org/cgit/utils/util-linux/util-linux.git/commit/?id=5600c40 -- BOFH excuse #65: system needs to be rebooted
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web