From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: ebiederm@xmission.com (Eric W. Biederman) To: Andy Lutomirski Cc: Jann Horn , Michal Hocko , "linux-kernel\@vger.kernel.org" , Linux Containers , Oleg Nesterov , "linux-mm\@kvack.org" , Linux FS Devel References: <87twcbq696.fsf@x220.int.ebiederm.org> <20161018135031.GB13117@dhcp22.suse.cz> <8737jt903u.fsf@xmission.com> <20161018150507.GP14666@pc.thejh.net> <87twc9656s.fsf@xmission.com> <20161018191206.GA1210@laptop.thejh.net> <87r37dnz74.fsf@xmission.com> <87k2d5nytz.fsf_-_@xmission.com> Date: Wed, 19 Oct 2016 11:52:50 -0500 In-Reply-To: (Andy Lutomirski's message of "Wed, 19 Oct 2016 08:30:14 -0700") Message-ID: <87y41kjn6l.fsf@xmission.com> MIME-Version: 1.0 Content-Type: text/plain Subject: Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. Sender: owner-linux-mm@kvack.org List-ID: Andy Lutomirski writes: > On Tue, Oct 18, 2016 at 2:15 PM, Eric W. Biederman > wrote: >> >> When the user namespace support was merged the need to prevent >> ptracing an executable that is not readable was overlooked. > > Before getting too excited about this fix, isn't there a much bigger > hole that's been there forever? In this case it was a newish hole (2011) that the user namespace support added that I am closing. I am not super excited but I figure it is useful to make the kernel semantics at least as secure as they were before. > Simply ptrace yourself, exec the > program, and then dump the program out. A program that really wants > to be unreadable should have a stub: the stub is setuid and readable, > but all the stub does is to exec the real program, and the real > program should have mode 0500 or similar. > > ISTM the "right" check would be to enforce that the program's new > creds can read the program, but that will break backwards > compatibility. Last I looked I had the impression that exec of a setuid program kills the ptrace. If we are talking about a exec of a simple unreadable executable (aka something that sets undumpable but is not setuid or setgid). Then I agree it should break the ptrace as well and since those programs are as rare as hens teeth I don't see any problem with changing the ptrace behavior in that case. Eric -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf0-f200.google.com (mail-pf0-f200.google.com [209.85.192.200]) by kanga.kvack.org (Postfix) with ESMTP id 8E9536B0267 for ; Wed, 19 Oct 2016 12:54:59 -0400 (EDT) Received: by mail-pf0-f200.google.com with SMTP id e6so1349129pfk.2 for ; Wed, 19 Oct 2016 09:54:59 -0700 (PDT) Received: from out02.mta.xmission.com (out02.mta.xmission.com. [166.70.13.232]) by mx.google.com with ESMTPS id a15si13235890pfa.272.2016.10.19.09.54.58 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 19 Oct 2016 09:54:58 -0700 (PDT) From: ebiederm@xmission.com (Eric W. Biederman) References: <87twcbq696.fsf@x220.int.ebiederm.org> <20161018135031.GB13117@dhcp22.suse.cz> <8737jt903u.fsf@xmission.com> <20161018150507.GP14666@pc.thejh.net> <87twc9656s.fsf@xmission.com> <20161018191206.GA1210@laptop.thejh.net> <87r37dnz74.fsf@xmission.com> <87k2d5nytz.fsf_-_@xmission.com> Date: Wed, 19 Oct 2016 11:52:50 -0500 In-Reply-To: (Andy Lutomirski's message of "Wed, 19 Oct 2016 08:30:14 -0700") Message-ID: <87y41kjn6l.fsf@xmission.com> MIME-Version: 1.0 Content-Type: text/plain Subject: Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. Sender: owner-linux-mm@kvack.org List-ID: To: Andy Lutomirski Cc: Jann Horn , Michal Hocko , "linux-kernel@vger.kernel.org" , Linux Containers , Oleg Nesterov , "linux-mm@kvack.org" , Linux FS Devel Andy Lutomirski writes: > On Tue, Oct 18, 2016 at 2:15 PM, Eric W. Biederman > wrote: >> >> When the user namespace support was merged the need to prevent >> ptracing an executable that is not readable was overlooked. > > Before getting too excited about this fix, isn't there a much bigger > hole that's been there forever? In this case it was a newish hole (2011) that the user namespace support added that I am closing. I am not super excited but I figure it is useful to make the kernel semantics at least as secure as they were before. > Simply ptrace yourself, exec the > program, and then dump the program out. A program that really wants > to be unreadable should have a stub: the stub is setuid and readable, > but all the stub does is to exec the real program, and the real > program should have mode 0500 or similar. > > ISTM the "right" check would be to enforce that the program's new > creds can read the program, but that will break backwards > compatibility. Last I looked I had the impression that exec of a setuid program kills the ptrace. If we are talking about a exec of a simple unreadable executable (aka something that sets undumpable but is not setuid or setgid). Then I agree it should break the ptrace as well and since those programs are as rare as hens teeth I don't see any problem with changing the ptrace behavior in that case. Eric -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S938595AbcJSQzC (ORCPT ); Wed, 19 Oct 2016 12:55:02 -0400 Received: from out02.mta.xmission.com ([166.70.13.232]:50797 "EHLO out02.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934157AbcJSQy7 (ORCPT ); Wed, 19 Oct 2016 12:54:59 -0400 From: ebiederm@xmission.com (Eric W. Biederman) To: Andy Lutomirski Cc: Jann Horn , Michal Hocko , "linux-kernel\@vger.kernel.org" , Linux Containers , Oleg Nesterov , "linux-mm\@kvack.org" , Linux FS Devel References: <87twcbq696.fsf@x220.int.ebiederm.org> <20161018135031.GB13117@dhcp22.suse.cz> <8737jt903u.fsf@xmission.com> <20161018150507.GP14666@pc.thejh.net> <87twc9656s.fsf@xmission.com> <20161018191206.GA1210@laptop.thejh.net> <87r37dnz74.fsf@xmission.com> <87k2d5nytz.fsf_-_@xmission.com> Date: Wed, 19 Oct 2016 11:52:50 -0500 In-Reply-To: (Andy Lutomirski's message of "Wed, 19 Oct 2016 08:30:14 -0700") Message-ID: <87y41kjn6l.fsf@xmission.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1bwu8n-0008JE-6Q;;;mid=<87y41kjn6l.fsf@xmission.com>;;;hst=in02.mta.xmission.com;;;ip=75.170.125.99;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX18twbZr7hekxdUg2tBtF6cb697ZMqyL0Lw= X-SA-Exim-Connect-IP: 75.170.125.99 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 1.5 TR_Symld_Words too many words that have symbols inside * 0.7 XMSubLong Long Subject * 0.0 TVD_RCVD_IP Message was received from an IP address * 0.0 T_TM2_M_HEADER_IN_MSG BODY: No description available. * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.4969] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa06 1397; Body=1 Fuz1=1 Fuz2=1] * 0.0 T_TooManySym_01 4+ unique symbols in subject X-Spam-DCC: XMission; sa06 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: **;Andy Lutomirski X-Spam-Relay-Country: X-Spam-Timing: total 220 ms - load_scoreonly_sql: 0.03 (0.0%), signal_user_changed: 3.4 (1.6%), b_tie_ro: 2.4 (1.1%), parse: 0.78 (0.4%), extract_message_metadata: 13 (6.0%), get_uri_detail_list: 1.18 (0.5%), tests_pri_-1000: 8 (3.4%), tests_pri_-950: 1.20 (0.5%), tests_pri_-900: 0.97 (0.4%), tests_pri_-400: 24 (10.8%), check_bayes: 23 (10.4%), b_tokenize: 6 (2.7%), b_tok_get_all: 9 (3.9%), b_comp_prob: 2.1 (0.9%), b_tok_touch_all: 3.3 (1.5%), b_finish: 1.17 (0.5%), tests_pri_0: 162 (73.5%), check_dkim_signature: 0.47 (0.2%), check_dkim_adsp: 3.5 (1.6%), tests_pri_500: 5 (2.3%), rewrite_mail: 0.00 (0.0%) Subject: Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Andy Lutomirski writes: > On Tue, Oct 18, 2016 at 2:15 PM, Eric W. Biederman > wrote: >> >> When the user namespace support was merged the need to prevent >> ptracing an executable that is not readable was overlooked. > > Before getting too excited about this fix, isn't there a much bigger > hole that's been there forever? In this case it was a newish hole (2011) that the user namespace support added that I am closing. I am not super excited but I figure it is useful to make the kernel semantics at least as secure as they were before. > Simply ptrace yourself, exec the > program, and then dump the program out. A program that really wants > to be unreadable should have a stub: the stub is setuid and readable, > but all the stub does is to exec the real program, and the real > program should have mode 0500 or similar. > > ISTM the "right" check would be to enforce that the program's new > creds can read the program, but that will break backwards > compatibility. Last I looked I had the impression that exec of a setuid program kills the ptrace. If we are talking about a exec of a simple unreadable executable (aka something that sets undumpable but is not setuid or setgid). Then I agree it should break the ptrace as well and since those programs are as rare as hens teeth I don't see any problem with changing the ptrace behavior in that case. Eric