[uml-devel] Hardening hostfs

[Doug Dumitru <doug@easyco.com>]

I have been trying to build a reasonably bullet-proof UML kernel that 
prevents users from doing hostfs mounts.

I have observed some behaviours which are non ideal.

1.  If hostfs is compiled in as a module, then the hostfs=... 
command-line arguments are not used.  Thus, trying to restrict access 
with this does not appear to be effective.

2.  If hostfs is not compiled in at all, you can still load a hostfs 
module assuming that you can build one off-line.  This would allow a 
compromise of an underlying system by a "moderate" hacker with root 
access to the virtual.

The best that I have come up with is:

o Run UML in a chroot jail.
o Compile UML with hostfs included and not as a module
o Supply a command line ... hostfs=/doesnotexist,append when booting

I don't think that this is perfect as you could still load a LKM and 
probably get to the underlying filesystem.  At least it is chroot'd at 
this point.

I have been trying to work out a way to further harden this, but there 
seem to be a number of stumbling blocks.

A lot of device open/close on the fly, so chrooting all of UML might be 
hard.  The best that I can think of is to build a chroot jail with only 
those devices.

You still have to deal with /proc/mm for SKAS mode (at least until the 
next SKAS interface shift).

-- 

--------------------------------------------------------------------
Doug Dumitru     800-470-2756     (610-237-2000)
EasyCo LLC       doug@easyco.com  http://easyco.com
--------------------------------------------------------------------
D3, U2, jBase Virtual Servers.    Off-site backup over the internet.
Develop/test/deploy from $20/mo.  Fast, secure, cheaper than tape.
http://mirroredservers.com        http://mirroredbackup.com



-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel