From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) Subject: Re: Requirements for CAP_SYS_ADMIN on setns() ? Date: Sat, 08 Jun 2013 22:33:12 -0700 Message-ID: <87y5ajzw4n.fsf@xmission.com> References: <20130606100149.GG30217@redhat.com> <20130606134802.GA2930@ac100> <87txlb8atb.fsf@xmission.com> <20130606164428.GA4687@austin.hallyn.com> <87bo7j6r80.fsf@xmission.com> <20130607093459.GB10742@redhat.com> <1370721249.2776.87@driftwood> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1370721249.2776.87@driftwood> (Rob Landley's message of "Sat, 08 Jun 2013 14:54:09 -0500") List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Rob Landley Cc: containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Serge Hallyn , Andy Lutomirski List-Id: containers.vger.kernel.org Rob Landley writes: > Waaaay behind on my email... > > On 06/07/2013 04:34:59 AM, Daniel P. Berrange wrote: >> On Thu, Jun 06, 2013 at 11:15:11AM -0700, Eric W. Biederman wrote: >> > "Serge E. Hallyn" writes: >> > setns requires CAP_SYS_ADMIN because changing the namespaces for >> your >> > children can result in tricking a suid root application and thus >> lead >> > to privilege escalation. >> >> Yep, ok I see that from the example shown earlier in the thread. >> >> > If you run setns inside a user namespace that you control the >> privilege >> > escalation is not possible and so setns is allowed. >> >> What are the privilege requirements for being able to call setns() on >> a user namespace FD ? >> >> Thinking some more, if there was a setpidns(pid_t containerpid) >> syscall >> which unconditionally joined the caller to all namespaces associated >> with >> the target pid, then you'd not have the security risk described, >> right ? > > Sounds like you want a reparent_to_init() that works for a container's > init. setns on all of the namespaces effectively gives you that ability. You probably want to play with cgroups and a few other similar things. And there is a utility in util-linux that automates at least the namespace portion of this called nsenter. Eric