From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm@xmission.com (Eric W. Biederman) References: <1531935483-30784-1-git-send-email-s.mesoraca16@gmail.com> Date: Fri, 20 Jul 2018 08:37:04 -0500 In-Reply-To: (Kees Cook's message of "Thu, 19 Jul 2018 22:15:15 -0700") Message-ID: <87effy9gfz.fsf@xmission.com> MIME-Version: 1.0 Content-Type: text/plain Subject: Re: [RFC] kconfig: add hardened defconfig helpers To: Salvatore Mesoraca Cc: Kernel Hardening , Laura Abbott , LKML , Masahiro Yamada , linux-doc@vger.kernel.org, Kees Cook List-ID: Kees Cook writes: >> +CONFIG_USER_NS=n >> +~~~~~~~~~~~~~~~~ >> + >> +**Negative side effects level:** Medium > > Unfortunately I think this is High or Extreme. USER_NS gets a lot of use. > >> +**- Protection type:** Attack surface reduction >> + >> +This allows containers to use user namespaces to provide different >> +user info for different servers. >> +User namespaces have been abused in the past for privilege >> +escalation. This is not a particularly good description. User namespaces do indeed increase the attack surface of programs that don't use them. User namespaces when used to build ``unprivileged containers'' remove or at least drastically reduce the need to run as root when setting up containers. Which is attack surface reduction. User namespaces make available tools that are commonly used to build sandboxes. Chrome for example uses users namespaces if they are available as part of setting up it's sandbox. User namespaces are not limited to containers. The bugs in the attack surface that user namespaces expose that have been used for privilege escalation have to the best of my knowledge closed. So while there is some danger in the increased attack surface we are looking at implementation defects rather than design defects. Eric From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on archive.lwn.net X-Spam-Level: X-Spam-Status: No, score=-5.8 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham autolearn_force=no version=3.4.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by archive.lwn.net (Postfix) with ESMTP id 7ACD97D072 for ; Fri, 20 Jul 2018 13:39:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731289AbeGTOZf (ORCPT ); Fri, 20 Jul 2018 10:25:35 -0400 Received: from out01.mta.xmission.com ([166.70.13.231]:36962 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727693AbeGTOZf (ORCPT ); Fri, 20 Jul 2018 10:25:35 -0400 Received: from in02.mta.xmission.com ([166.70.13.52]) by out01.mta.xmission.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.87) (envelope-from ) id 1fgVar-0003U7-6u; Fri, 20 Jul 2018 07:37:13 -0600 Received: from [97.119.167.31] (helo=x220.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.87) (envelope-from ) id 1fgVaq-0005gt-LB; Fri, 20 Jul 2018 07:37:13 -0600 From: ebiederm@xmission.com (Eric W. Biederman) To: Salvatore Mesoraca Cc: Kernel Hardening , Laura Abbott , LKML , Masahiro Yamada , linux-doc@vger.kernel.org, Kees Cook References: <1531935483-30784-1-git-send-email-s.mesoraca16@gmail.com> Date: Fri, 20 Jul 2018 08:37:04 -0500 In-Reply-To: (Kees Cook's message of "Thu, 19 Jul 2018 22:15:15 -0700") Message-ID: <87effy9gfz.fsf@xmission.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1fgVaq-0005gt-LB;;;mid=<87effy9gfz.fsf@xmission.com>;;;hst=in02.mta.xmission.com;;;ip=97.119.167.31;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1/hahftwkIP0ZjnYet3ZaYXea+PRQt0Z6I= X-SA-Exim-Connect-IP: 97.119.167.31 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: [RFC] kconfig: add hardened defconfig helpers X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-doc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-doc@vger.kernel.org Kees Cook writes: >> +CONFIG_USER_NS=n >> +~~~~~~~~~~~~~~~~ >> + >> +**Negative side effects level:** Medium > > Unfortunately I think this is High or Extreme. USER_NS gets a lot of use. > >> +**- Protection type:** Attack surface reduction >> + >> +This allows containers to use user namespaces to provide different >> +user info for different servers. >> +User namespaces have been abused in the past for privilege >> +escalation. This is not a particularly good description. User namespaces do indeed increase the attack surface of programs that don't use them. User namespaces when used to build ``unprivileged containers'' remove or at least drastically reduce the need to run as root when setting up containers. Which is attack surface reduction. User namespaces make available tools that are commonly used to build sandboxes. Chrome for example uses users namespaces if they are available as part of setting up it's sandbox. User namespaces are not limited to containers. The bugs in the attack surface that user namespaces expose that have been used for privilege escalation have to the best of my knowledge closed. So while there is some danger in the increased attack surface we are looking at implementation defects rather than design defects. Eric -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html