From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman)
To: "Serge E. Hallyn" <serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org>
Cc: linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org,
Linus Torvalds
<torvalds-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>,
Linux Kernel Mailing List
<linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org>
Subject: Re: [RFC][PATCH] Fix cap_capable to only allow owners in the parent user namespace to have caps.
Date: Fri, 14 Dec 2012 14:32:12 -0800 [thread overview]
Message-ID: <87bodww9hv.fsf@xmission.com> (raw)
In-Reply-To: <20121214202921.GA11450-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org> (Serge E. Hallyn's message of "Fri, 14 Dec 2012 20:29:21 +0000")
"Serge E. Hallyn" <serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org> writes:
> Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org):
>> A child user namespace having capabilities against processes in it's
>> parent seems totally bizarre and pretty dangerous from a capabilities
>> standpoint.
>
> How would it have them against its parent?
init_user_ns
userns a --- created by kuid 1
userns b -- created by kuid 2
process c in userns b with kuid 1
Serge read the first permisison check in common_cap.
Think what happens in the above example.
For the rest I understand your concern.
Serge please read and look at the patches I have posted to fix
the issues Andy found with the user namespace tree. Especially
the fix to commit_creds.
After you have looked at the patches to fix the issues I will
be happy to discuss things further with you.
Eric
WARNING: multiple messages have this Message-ID (diff)
From: ebiederm@xmission.com (Eric W. Biederman)
To: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
containers@lists.linux-foundation.org,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Andy Lutomirski <luto@amacapital.net>,
linux-security-module@vger.kernel.org
Subject: Re: [RFC][PATCH] Fix cap_capable to only allow owners in the parent user namespace to have caps.
Date: Fri, 14 Dec 2012 14:32:12 -0800 [thread overview]
Message-ID: <87bodww9hv.fsf@xmission.com> (raw)
In-Reply-To: <20121214202921.GA11450@mail.hallyn.com> (Serge E. Hallyn's message of "Fri, 14 Dec 2012 20:29:21 +0000")
"Serge E. Hallyn" <serge@hallyn.com> writes:
> Quoting Eric W. Biederman (ebiederm@xmission.com):
>> A child user namespace having capabilities against processes in it's
>> parent seems totally bizarre and pretty dangerous from a capabilities
>> standpoint.
>
> How would it have them against its parent?
init_user_ns
userns a --- created by kuid 1
userns b -- created by kuid 2
process c in userns b with kuid 1
Serge read the first permisison check in common_cap.
Think what happens in the above example.
For the rest I understand your concern.
Serge please read and look at the patches I have posted to fix
the issues Andy found with the user namespace tree. Especially
the fix to commit_creds.
After you have looked at the patches to fix the issues I will
be happy to discuss things further with you.
Eric
next prev parent reply other threads:[~2012-12-14 22:32 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-12-11 21:17 [GIT PULL] user namespace and namespace infrastructure changes for 3.8 Eric W. Biederman
2012-12-11 21:17 ` Eric W. Biederman
[not found] ` <87ip88uw4n.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-12-13 19:24 ` Andy Lutomirski
2012-12-13 19:24 ` Andy Lutomirski
[not found] ` <50CA2B55.5070402-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org>
2012-12-13 22:01 ` Eric W. Biederman
2012-12-13 22:01 ` Eric W. Biederman
2012-12-13 22:39 ` [RFC][PATCH] Fix cap_capable to only allow owners in the parent user namespace to have caps Eric W. Biederman
[not found] ` <87zk1hshk7.fsf_-_-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-12-13 22:43 ` Linus Torvalds
2012-12-13 22:43 ` Linus Torvalds
2012-12-13 22:55 ` Eric W. Biederman
[not found] ` <CA+55aFwXnFEFXbkwFPq9xt30xp2_6jfpBLd3E2bms79KKK=V1Q-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2012-12-13 22:55 ` Eric W. Biederman
2012-12-13 23:21 ` Andy Lutomirski
2012-12-14 3:28 ` Serge E. Hallyn
2012-12-13 23:21 ` Andy Lutomirski
[not found] ` <CALCETrXLLcUu8Rajjx7+3N_6j5E0T0CR1h=hD+gcc5_r4Umyqw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2012-12-14 2:33 ` Eric W. Biederman
2012-12-14 2:33 ` Eric W. Biederman
2012-12-14 2:36 ` Andy Lutomirski
2012-12-14 3:20 ` [PATCH] " Eric W. Biederman
[not found] ` <CALCETrXRYOh2tkwB+U9ZjA5BNZwscWsq1WGzjP3wUiOXQUXOQg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2012-12-14 3:20 ` Eric W. Biederman
[not found] ` <876245jrbc.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-12-14 2:36 ` [RFC][PATCH] " Andy Lutomirski
2012-12-14 3:28 ` Serge E. Hallyn
[not found] ` <20121214032820.GA5115-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>
2012-12-14 3:32 ` Eric W. Biederman
2012-12-14 3:32 ` Eric W. Biederman
[not found] ` <87bodxi9zw.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-12-14 15:26 ` Serge E. Hallyn
2012-12-14 15:26 ` Serge E. Hallyn
2012-12-14 15:47 ` Eric W. Biederman
[not found] ` <87bodwd4aw.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-12-14 16:15 ` Serge E. Hallyn
2012-12-14 16:15 ` Serge E. Hallyn
[not found] ` <20121214161514.GA9962-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>
2012-12-14 18:12 ` Eric W. Biederman
2012-12-14 18:12 ` Eric W. Biederman
[not found] ` <87r4ms5wpm.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-12-14 18:43 ` Linus Torvalds
2012-12-14 18:43 ` Linus Torvalds
2012-12-14 18:47 ` Andy Lutomirski
[not found] ` <CA+55aFw5CMf0-o=yDt2Rj-SYH4pfW1L9QbNb6uKHEdzAyYcvGQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2012-12-14 18:47 ` Andy Lutomirski
2012-12-14 20:50 ` Serge E. Hallyn
2012-12-14 21:43 ` Eric W. Biederman
2012-12-14 20:50 ` Serge E. Hallyn
2012-12-14 21:43 ` Eric W. Biederman
2012-12-14 20:29 ` Serge E. Hallyn
2012-12-14 20:29 ` Serge E. Hallyn
[not found] ` <20121214202921.GA11450-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>
2012-12-14 22:32 ` Eric W. Biederman [this message]
2012-12-14 22:32 ` Eric W. Biederman
[not found] ` <87bodww9hv.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-12-15 0:14 ` Serge E. Hallyn
2012-12-15 0:14 ` Serge E. Hallyn
[not found] ` <20121214152607.GA9266-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>
2012-12-14 15:47 ` Eric W. Biederman
[not found] ` <87mwxhtxve.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-12-13 22:39 ` Eric W. Biederman
2012-12-13 23:02 ` [GIT PULL] user namespace and namespace infrastructure changes for 3.8 Andy Lutomirski
2012-12-13 23:02 ` Andy Lutomirski
[not found] ` <CALCETrWxXZ1OzZeH_SGeg1E16rssxBwg+hjG09N5dkqweVKeRA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2012-12-14 4:11 ` Eric W. Biederman
2012-12-14 4:11 ` Eric W. Biederman
[not found] ` <87mwxhff2e.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-12-14 5:34 ` Andy Lutomirski
2012-12-14 5:34 ` Andy Lutomirski
[not found] ` <CALCETrXagfjy4o0_JCZpMfdocYK-MpOp3eH-tPZhgazvJAy-EQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2012-12-14 17:48 ` Eric W. Biederman
2012-12-14 17:48 ` Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87bodww9hv.fsf@xmission.com \
--to=ebiederm-as9lmozglivwk0htik3j/w@public.gmane.org \
--cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
--cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org \
--cc=serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org \
--cc=torvalds-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.