From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) Subject: Re: [PATCH] Move console redirect to pid namespace Date: Wed, 13 Feb 2013 11:08:23 -0800 Message-ID: <87r4kkuj4o.fsf@xmission.com> References: <1360376920-30824-1-git-send-email-minyard@acm.org> <20130209191409.643c3d7f@neptune.home> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: <20130209191409.643c3d7f-hY15tx4IgV39zxVx7UNMDg@public.gmane.org> ("Bruno \=\?utf-8\?Q\?Pr\?\= \=\?utf-8\?Q\?\=C3\=A9mont\=22's\?\= message of "Sat, 9 Feb 2013 19:14:09 +0100") List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Bruno =?utf-8?Q?Pr=C3=A9mont?= Cc: Corey Minyard , containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Linux Kernel , Corey Minyard List-Id: containers.vger.kernel.org QnJ1bm8gUHLDqW1vbnQgPGJvbmJvbnNAbGludXgtdnNlcnZlci5vcmc+IHdyaXRlczoKCj4gQ0Np bmcgY29udGFpbmVycyBsaXN0Cj4KPiBPbiBGcmksIDA4IEZlYnJ1YXJ5IDIwMTMgbWlueWFyZEBh Y20ub3JnIHdyb3RlOgo+PiBGcm9tOiBDb3JleSBNaW55YXJkIDxjbWlueWFyZEBtdmlzdGEuY29t Pgo+PiAKPj4gVGhlIGNvbnNvbGUgcmVkaXJlY3QgLSBpb2N0bChmZCwgVElPQ0NPTlMpIC0gaXMg bm90IGluIGEgbmFtZXNwYWNlLAo+PiB0aHVzIGEgY29udGFpbmVyIGNhbiBkbyBhIHJlZGlyZWN0 IGFuZCBncmFiIGFsbCB0aGUgSS9PIG9uIHRoZSBob3N0Cj4+IGFuZCBhbGwgY29udGFpbmVyIGNv bnNvbGVzLgo+PiAKPj4gVGhpcyBjaGFuZ2UgcHV0cyB0aGUgcmVkaXJlY3QgaW4gdGhlIHBpZCBu YW1lc3BhY2UuCj4+IAo+PiBTaWduZWQtb2ZmLWJ5OiBDb3JleSBNaW55YXJkIDxjbWlueWFyZEBt dmlzdGEuY29tPgo+PiAtLS0KPj4gCj4+IEknbSBwcmV0dHkgc3VyZSB0aGlzIHBhdGNoIGlzIG5v dCBjb3JyZWN0LCBidXQgSSdtIG5vdCBxdWl0ZSBzdXJlIHRoZQo+PiBiZXN0IHdheSB0byBmaXgg dGhpcy4gIEknbSBub3QgMTAwJSBzdXJlIHRoYXQgdGhlIHBpZCBuYW1lc3BhY2UgaXMgdGhlCj4+ IHJpZ2h0IHBsYWNlLCBidXQgaXQgc2VlbWVkIHRoZSBtb3N0IHJlYXNvbmFibGUgb2YgYWxsIHRo ZSBjaG9pY2VzLiAgVGhlCj4+IG90aGVyIG9idmlvdXMgY2hvaWNlIGlzIHRoZSBtb3VudCBuYW1l c3BhY2UsIGJ1dCBpdCBkaWRuJ3Qgc2VlbSBhcyBnb29kCj4+IGEgZml0Lgo+Cj4gV2l0aCByZWNl bnQgY2hhbmdlcywgdHlpbmcgaXQgdG8gaW5pdCB1c2VyIG5hbWVzcGFjZSBtaWdodCBldmVuIGJl Cj4gYmV0dGVyLgoKV2l0aCByZWNlbnQgY2hhbmdlcyB0aGlzIGlzIHRpZWQgdG8gdGhlIGluaXRp YWwgdXNlciBuYW1lc3BhY2UuICBTbyB0aGUKc2ltcGxlIHNvbHV0aW9uIHRvIHRoaXMgYW5kIHNv IG1hbnkgb3RoZXIgc2ltaWxpYXIgc2VjdXJpdHkgcHJvYmxlbXMgaXMKdG8gcnVuIHlvdXIgY29u dGFpbmVyIGluIGEgdXNlciBuYW1lc3BhY2UuCgpUaGUgcGVybWlzc2lvbiBjaGVjayBjdXJyZW50 bHkgaXMgY2FwYWJsZShDQVBfU1lTX0FETUlOKSB3aGljaCByZXF1aXJlcwp0aGUgY2FsbGVyIHRv IGhhdmUgdGhlIENBUF9TWVNfQURNSU4gaW4gdGhlIGluaXRpYWwgdXNlciBuYW1lc3BhY2UuCgpJ cyB0aGVyZSBhIGRlc2lyZSB0byBoYXZlIFRJT0NDT05TIG5vdCBqdXN0IGZhaWwgaW4gYSBjb250 YWluZXIgYnV0IHRvCmhhdmUgVElPQ0NPTlMgd29yayBpbiBhIGNvbnRhaW5lciBzcGVjaWZpYyB3 YXk/Cgo+PiBUaGUgb3RoZXIgcHJvYmxlbSBpcyB0aGF0IEkgZG9uJ3QgdGhpbmsgeW91IGNhbiBj YWxsIGZwdXQoKSBmcm9tCj4+IGRlc3Ryb3lfcGlkX25hbWVzcGFjZSgpLiAgVGhhdCBjYW4gYmUg Y2FsbGVkIGZyb20gaW50ZXJydXB0IGNvbnRleHQsCj4+IGFuZCBJIGRvbid0IHRoaW5rIGZwdXQo KSBpcyBzYWZlIHRoZXJlLiAgSSBrbm93IGl0J3Mgbm90IHNhZmUgaW4gMy40Cj4+IHdpdGggdGhl IFJUIHBhdGNoIGFwcGxpZWQuICBIb3dldmVyLCB0aGUgb25seSB3YXkgSSd2ZSBjb21lIHVwIHdp dGggdG8KPj4gZml4IGl0IGlzIHRvIGFkZCBhIHdvcmtxdWV1ZSwgYW5kIHRoYXQgc2VlbXMgYSBi aXQgaGVhdnkgZm9yIHRoaXMuCgpBY3R1YWxseSBnZXR0aW5nIGRlc3Ryb3lfcGlkX25hbWVzcGFj ZSBvdXQgb2YgaW50ZXJydXB0IGNvbnRleHQgd291bGRuJ3QKYmUgdGhlIHdvcnN0IHRoaW5nIGlu IHRoZSB3b3JsZC4KCkVyaWMKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18KQ29udGFpbmVycyBtYWlsaW5nIGxpc3QKQ29udGFpbmVyc0BsaXN0cy5saW51eC1m b3VuZGF0aW9uLm9yZwpodHRwczovL2xpc3RzLmxpbnV4Zm91bmRhdGlvbi5vcmcvbWFpbG1hbi9s aXN0aW5mby9jb250YWluZXJz From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933759Ab3BMTId (ORCPT ); Wed, 13 Feb 2013 14:08:33 -0500 Received: from out01.mta.xmission.com ([166.70.13.231]:43441 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758662Ab3BMTIb convert rfc822-to-8bit (ORCPT ); Wed, 13 Feb 2013 14:08:31 -0500 From: ebiederm@xmission.com (Eric W. Biederman) To: Bruno =?utf-8?Q?Pr=C3=A9mont?= Cc: Corey Minyard , Corey Minyard , containers@lists.linux-foundation.org, Linux Kernel References: <1360376920-30824-1-git-send-email-minyard@acm.org> <20130209191409.643c3d7f@neptune.home> Date: Wed, 13 Feb 2013 11:08:23 -0800 In-Reply-To: <20130209191409.643c3d7f@neptune.home> ("Bruno \=\?utf-8\?Q\?Pr\?\= \=\?utf-8\?Q\?\=C3\=A9mont\=22's\?\= message of "Sat, 9 Feb 2013 19:14:09 +0100") Message-ID: <87r4kkuj4o.fsf@xmission.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8BIT X-XM-AID: U2FsdGVkX1/OsnvEJPHlhbFBq3FGvI99J7i7dhwHaKA= X-SA-Exim-Connect-IP: 98.207.153.68 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.0 T_TM2_M_HEADER_IN_MSG BODY: T_TM2_M_HEADER_IN_MSG * -3.0 BAYES_00 BODY: Bayes spam probability is 0 to 1% * [score: 0.0001] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa06 1397; Body=1 Fuz1=1 Fuz2=1] X-Spam-DCC: XMission; sa06 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: =?ISO-8859-1?Q?;Bruno Pr=c3=a9mont ?= X-Spam-Relay-Country: Subject: Re: [PATCH] Move console redirect to pid namespace X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Bruno Prémont writes: > CCing containers list > > On Fri, 08 February 2013 minyard@acm.org wrote: >> From: Corey Minyard >> >> The console redirect - ioctl(fd, TIOCCONS) - is not in a namespace, >> thus a container can do a redirect and grab all the I/O on the host >> and all container consoles. >> >> This change puts the redirect in the pid namespace. >> >> Signed-off-by: Corey Minyard >> --- >> >> I'm pretty sure this patch is not correct, but I'm not quite sure the >> best way to fix this. I'm not 100% sure that the pid namespace is the >> right place, but it seemed the most reasonable of all the choices. The >> other obvious choice is the mount namespace, but it didn't seem as good >> a fit. > > With recent changes, tying it to init user namespace might even be > better. With recent changes this is tied to the initial user namespace. So the simple solution to this and so many other similiar security problems is to run your container in a user namespace. The permission check currently is capable(CAP_SYS_ADMIN) which requires the caller to have the CAP_SYS_ADMIN in the initial user namespace. Is there a desire to have TIOCCONS not just fail in a container but to have TIOCCONS work in a container specific way? >> The other problem is that I don't think you can call fput() from >> destroy_pid_namespace(). That can be called from interrupt context, >> and I don't think fput() is safe there. I know it's not safe in 3.4 >> with the RT patch applied. However, the only way I've come up with to >> fix it is to add a workqueue, and that seems a bit heavy for this. Actually getting destroy_pid_namespace out of interrupt context wouldn't be the worst thing in the world. Eric