From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from sub5.mail.dreamhost.com ([208.113.200.129]:53964 "EHLO homiemail-a40.g.dreamhost.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756946AbcKCUnZ (ORCPT ); Thu, 3 Nov 2016 16:43:25 -0400 Received: from homiemail-a40.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a40.g.dreamhost.com (Postfix) with ESMTP id 7D68B600423C for ; Thu, 3 Nov 2016 13:43:24 -0700 (PDT) Received: from kmjvbox (c-73-202-117-160.hsd1.ca.comcast.net [73.202.117.160]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: kjlx@templeofstupid.com) by homiemail-a40.g.dreamhost.com (Postfix) with ESMTPSA id 300216004114 for ; Thu, 3 Nov 2016 13:43:24 -0700 (PDT) Date: Thu, 3 Nov 2016 13:43:22 -0700 From: Krister Johansen To: "Eric W. Biederman" Cc: Jann Horn , Krister Johansen , Alexander Viro , Roland McGrath , Oleg Nesterov , John Johansen , James Morris , "Serge E. Hallyn" , Paul Moore , Stephen Smalley , Eric Paris , Casey Schaufler , Kees Cook , Andrew Morton , Janis Danisevskis , Seth Forshee , Thomas Gleixner , Benjamin LaHaise , Ben Hutchings , Andy Lutomirski , Linus Torvalds , linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, security@kernel.org Subject: Re: [PATCH v2 8/8] Documentation: add security/ptrace_checks.txt Message-ID: <20161103204321.GA2940@templeofstupid.com> References: <1474663238-22134-1-git-send-email-jann@thejh.net> <1474663238-22134-9-git-send-email-jann@thejh.net> <20161002031600.GC2635@templeofstupid.com> <20161030190915.GD2558@pc.thejh.net> <87d1ih5f5f.fsf@xmission.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87d1ih5f5f.fsf@xmission.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Sun, Oct 30, 2016 at 11:14:04PM -0500, Eric W. Biederman wrote: > Jann Horn writes: > > > On Sat, Oct 01, 2016 at 08:16:00PM -0700, Krister Johansen wrote: > >> On Fri, Sep 23, 2016 at 10:40:38PM +0200, Jann Horn wrote: > >> > +===================== > >> > +FILESYSTEM DEBUG APIS > >> > +===================== > >> > + > >> > +The pid / tgid entries in procfs contain various entries that allow debugging > >> > +access to a process. Interesting entries are: > >> > + > >> > + - auxv permits an ASLR bypass > >> > + - cwd can permit bypassing filesystem restrictions in some cases > >> > + - environ can leak secret tokens > >> > + - fd can permit bypassing filesystem restrictions or leak access to things like > >> > + pipes > >> > + - maps permits an ASLR bypass > >> > + - mem grants R+W access to process memory > >> > + - stat permits an ASLR bypass > >> > + > >> > +Of these, all use both a normal filesystem DAC check (where the file owner is > >> > +the process owner for a dumpable process, root for a nondumpable process) and a > >> > +ptrace_may_access() check; however, the DAC check may be modified, and the > >> > +ptrace_may_access() is performed under PTRACE_FSCREDS, meaning that instead of > >> > +the caller's ruid, rgid and permitted capabilities, the fsuid, fsgid and > >> > +effective capabilities are used, causing the case where a daemon drops its euid > >> > +prior to accessing a file for the user to be treated correctly for this check. > >> > >> Thanks for writing this up. > >> > >> Is it worth mentioning some of the less obvious aspects of how user > >> namespaces interact with the filesystem debug APIs? Of particular note: > >> a nondumpable process will always be assigned the global root ids. > >> Checks against capabilities for procfs require that the uid and gid have > >> a mapping in the current namepsace. That's enforced through > >> capable_wrt_inode_uidgid(). > > > > Yeah, makes sense. Added that. Thanks! > > That will actually be changing for 4.10. mm->user_ns allows me to use > the user namespace id 0 if that id is mapped. I'll be excited to sync up with this change once you land it in 4.10. There are a bunch of tools that get confused if you run them in a user namespace but they can't access /proc/[pid]/whatever. -K