Re: [PATCH] System Wide Capability Bounding Set

[Eric Paris <eparis@redhat.com>]

On Fri, 2011-01-28 at 13:38 -0600, Serge E. Hallyn wrote:
> Quoting Steve Grubb (sgrubb@redhat.com):
> > On Friday, January 28, 2011 01:49:01 pm Serge E. Hallyn wrote:
> > > > Using a wrapper program is a NOGO because the admin renting the machine
> > > > would be able  to overwrite the wrapper and then they have arbitrary
> > > > code running with full privs and
> > > 
> > > Not sure I've got this.  Wrapper program in the VM he can over-write,
> > > but then he can overwrite the kernel too.
> > 
> > No, because the kernel is only read in at boot. After that, /boot can disapear and it 
> 
> And you can set it up so userspace cannot remount it, I assume?

Undecided at this time.  There are 2 possibilities.  We will either
expose a small partition to the VM which the hypervisor enforces RO
access which contains the kernel, initrd, and bootloader (so basically
a /boot).  This is what I have been thinking.  Or we may just directly
launch a kernel and initrd from the hypervisor and those files need
never be exposed to the VM at all.  In an case, there will be no
possibility that root in the VM will be able to modify their kernel or
initrd.  The plan is to implement capability restrictions inside the
initrd.

> > > In other words, we have to accept that the TCB is always not just the
> > > kernel, but some user-space too.  And yes, the wrapper program here
> > > would be part of the TCB.

That's correct, the TCB is going to be the kernel+initrd.  We must
accomplish all lockdowns inside the initrd before control is passed to
the root admin.

The helper script idea doesn't appear to meet the goal since the admin
would have control over the complete filesystem namespace and would be
able bypass it altogether (sgrubb mentioned bind mounting on top of it,
even if they couldn't overwrite it)