From: Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org>
To: Vivek Goyal <vgoyal-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org,
tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org
Cc: ssorce-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org,
jkaluza-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org,
lpoetter-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org,
kay-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org
Subject: Re: [PATCH 2/2] net: Implement SO_PEERCGROUP
Date: Wed, 12 Mar 2014 14:00:28 -0700 [thread overview]
Message-ID: <5320CAEC.6030008@amacapital.net> (raw)
In-Reply-To: <1394657163-7472-3-git-send-email-vgoyal-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
On 03/12/2014 01:46 PM, Vivek Goyal wrote:
> Implement SO_PEERCGROUP along the lines of SO_PEERCRED. This returns the
> cgroup of first mounted hierarchy of the task. For the case of client,
> it represents the cgroup of client at the time of opening the connection.
> After that client cgroup might change.
Even if people decide that sending cgroups over a unix socket is a good
idea, this API has my NAK in the strongest possible sense, for whatever
my NAK is worth.
IMO SO_PEERCRED is a disaster. Calling send(2) or write(2) should
*never* imply the use of a credential. A program should always have to
*explicitly* request use of a credential. What you want is SCM_CGROUP.
(I've found privilege escalations before based on this observation, and
I suspect I'll find them again.)
Note that I think that you really want SCM_SOMETHING_ELSE and not
SCM_CGROUP, but I don't know what the use case is yet.
--Andy
WARNING: multiple messages have this Message-ID (diff)
From: Andy Lutomirski <luto@amacapital.net>
To: Vivek Goyal <vgoyal@redhat.com>,
linux-kernel@vger.kernel.org, cgroups@vger.kernel.org,
netdev@vger.kernel.org, davem@davemloft.net, tj@kernel.org
Cc: ssorce@redhat.com, jkaluza@redhat.com, lpoetter@redhat.com,
kay@redhat.com
Subject: Re: [PATCH 2/2] net: Implement SO_PEERCGROUP
Date: Wed, 12 Mar 2014 14:00:28 -0700 [thread overview]
Message-ID: <5320CAEC.6030008@amacapital.net> (raw)
In-Reply-To: <1394657163-7472-3-git-send-email-vgoyal@redhat.com>
On 03/12/2014 01:46 PM, Vivek Goyal wrote:
> Implement SO_PEERCGROUP along the lines of SO_PEERCRED. This returns the
> cgroup of first mounted hierarchy of the task. For the case of client,
> it represents the cgroup of client at the time of opening the connection.
> After that client cgroup might change.
Even if people decide that sending cgroups over a unix socket is a good
idea, this API has my NAK in the strongest possible sense, for whatever
my NAK is worth.
IMO SO_PEERCRED is a disaster. Calling send(2) or write(2) should
*never* imply the use of a credential. A program should always have to
*explicitly* request use of a credential. What you want is SCM_CGROUP.
(I've found privilege escalations before based on this observation, and
I suspect I'll find them again.)
Note that I think that you really want SCM_SOMETHING_ELSE and not
SCM_CGROUP, but I don't know what the use case is yet.
--Andy
next prev parent reply other threads:[~2014-03-12 21:00 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-03-12 20:46 [PATCH 0/2][V2] net: Implement SO_PEERCGROUP to get cgroup of peer Vivek Goyal
2014-03-12 20:46 ` [PATCH 1/2] cgroup: Provide empty definition of task_cgroup_path() Vivek Goyal
2014-03-12 20:46 ` [PATCH 2/2] net: Implement SO_PEERCGROUP Vivek Goyal
2014-03-12 20:58 ` Cong Wang
[not found] ` <CAHA+R7OrNoa7_J-rOskxgdvkM5gAnQyoFBeCXSziY7XMd-yLNA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-03-13 13:48 ` Vivek Goyal
2014-03-13 13:48 ` Vivek Goyal
[not found] ` <1394657163-7472-3-git-send-email-vgoyal-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2014-03-12 21:00 ` Andy Lutomirski [this message]
2014-03-12 21:00 ` Andy Lutomirski
2014-03-12 21:12 ` Andy Lutomirski
[not found] ` <CALCETrUTjN=XKwnO62P9roZtLLuk7_9Oi17Mj_Aa2ZFtZc1gVA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-03-12 21:16 ` Simo Sorce
2014-03-12 21:16 ` Simo Sorce
[not found] ` <1394658983.32465.203.camel-Hs+ccMQdwurzDu64bZtGtWD2FQJk+8+b@public.gmane.org>
2014-03-12 21:19 ` Andy Lutomirski
2014-03-12 21:19 ` Andy Lutomirski
[not found] ` <CALCETrU29CpcK4dVRD45BGOD7AVEudADiFxOgFgKWkpFzw07eg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-03-13 1:17 ` Simo Sorce
2014-03-13 1:17 ` Simo Sorce
[not found] ` <1394673476.32465.215.camel-Hs+ccMQdwurzDu64bZtGtWD2FQJk+8+b@public.gmane.org>
2014-03-13 1:21 ` Andy Lutomirski
2014-03-13 1:21 ` Andy Lutomirski
[not found] ` <CALCETrWbCuKfV4zMkZajDOGhGkKduW0C2L7uHv=vtvqhVeAc6w-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-03-13 1:43 ` Simo Sorce
2014-03-13 1:43 ` Simo Sorce
[not found] ` <1394675038.32465.223.camel-Hs+ccMQdwurzDu64bZtGtWD2FQJk+8+b@public.gmane.org>
2014-03-13 2:12 ` Andy Lutomirski
2014-03-13 2:12 ` Andy Lutomirski
2014-03-13 14:27 ` Vivek Goyal
[not found] ` <20140313142755.GC18914-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2014-03-14 23:54 ` Eric W. Biederman
2014-03-14 23:54 ` Eric W. Biederman
2014-03-14 23:54 ` Eric W. Biederman
[not found] ` <CALCETrV7GE0YL1sDDqTUV81rWL9zk2vTR1-VLkR7CfTA-FSrgw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-03-13 17:51 ` Simo Sorce
2014-03-13 17:51 ` Simo Sorce
2014-03-13 17:55 ` Andy Lutomirski
[not found] ` <CALCETrXWzja6W6y=p9MrtynGZMsrD5KQu0KBK6Bs1dQxnesv2A-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-03-13 17:57 ` Simo Sorce
2014-03-13 17:57 ` Simo Sorce
[not found] ` <1394733448.32465.249.camel-Hs+ccMQdwurzDu64bZtGtWD2FQJk+8+b@public.gmane.org>
2014-03-13 18:03 ` Andy Lutomirski
2014-03-13 18:03 ` Andy Lutomirski
2014-03-13 17:58 ` Simo Sorce
2014-03-13 17:58 ` Simo Sorce
2014-03-13 18:01 ` Andy Lutomirski
2014-03-13 18:05 ` Tim Hockin
2014-03-13 19:53 ` Vivek Goyal
2014-03-13 19:58 ` Andy Lutomirski
2014-03-13 20:06 ` Vivek Goyal
[not found] ` <20140313200649.GN18914-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2014-03-13 20:17 ` Vivek Goyal
2014-03-13 20:17 ` Vivek Goyal
[not found] ` <20140313201755.GO18914-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2014-03-13 20:19 ` Vivek Goyal
2014-03-13 20:19 ` Vivek Goyal
2014-03-13 21:21 ` Andy Lutomirski
2014-03-13 21:21 ` Andy Lutomirski
2014-03-14 23:49 ` Eric W. Biederman
2014-03-14 23:49 ` Eric W. Biederman
2014-03-14 23:49 ` Eric W. Biederman
2014-03-13 18:02 ` Vivek Goyal
2014-03-13 14:14 ` Vivek Goyal
[not found] ` <20140313141422.GB18914-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2014-03-13 14:55 ` Simo Sorce
2014-03-13 14:55 ` Simo Sorce
[not found] ` <1394722534.32465.227.camel-Hs+ccMQdwurzDu64bZtGtWD2FQJk+8+b@public.gmane.org>
2014-03-13 15:00 ` Vivek Goyal
2014-03-13 15:00 ` Vivek Goyal
[not found] ` <20140313150034.GG18914-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2014-03-13 16:33 ` Simo Sorce
2014-03-13 16:33 ` Simo Sorce
2014-03-13 17:25 ` Andy Lutomirski
2014-03-13 17:55 ` Simo Sorce
2014-03-13 17:56 ` Tim Hockin
[not found] ` <1394657163-7472-1-git-send-email-vgoyal-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2014-03-12 20:56 ` [PATCH 0/2][V2] net: Implement SO_PEERCGROUP to get cgroup of peer Andy Lutomirski
2014-03-12 20:56 ` Andy Lutomirski
2014-03-12 20:59 ` Simo Sorce
[not found] ` <1394657970.32465.200.camel-Hs+ccMQdwurzDu64bZtGtWD2FQJk+8+b@public.gmane.org>
2014-03-12 21:09 ` Andy Lutomirski
2014-03-12 21:09 ` Andy Lutomirski
-- strict thread matches above, loose matches on Subject: below --
2014-03-12 18:45 [PATCH 0/2] " Vivek Goyal
2014-03-12 18:45 ` [PATCH 2/2] net: Implement SO_PEERCGROUP Vivek Goyal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5320CAEC.6030008@amacapital.net \
--to=luto-klttt9wpgjjwatoyat5jvq@public.gmane.org \
--cc=cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org \
--cc=jkaluza-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
--cc=kay-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
--cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=lpoetter-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
--cc=netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=ssorce-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
--cc=tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
--cc=vgoyal-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.