From: James Morris <james.l.morris@oracle.com>
To: Djalal Harouni <tixxdz@gmail.com>
Cc: Kees Cook <keescook@chromium.org>,
Alexey Gladkov <gladkov.alexey@gmail.com>,
Andy Lutomirski <luto@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-hardening@lists.openwall.com,
linux-security-module@vger.kernel.org, linux-api@vger.kernel.org,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Akinobu Mita <akinobu.mita@gmail.com>,
me@tobin.cc, Oleg Nesterov <oleg@redhat.com>,
Jeff Layton <jlayton@poochiereds.net>,
Ingo Molnar <mingo@kernel.org>,
Alexey Dobriyan <adobriyan@gmail.com>,
ebiederm@xmission.com,
Linus Torvalds <torvalds@linux-foundation.org>,
Daniel Micay <danielmicay@gmail.com>,
Jonathan Corbet <corbet@lwn.net>,
bfields@fieldses.org, Stephen Rothwell <sfr@canb.auug.org.au>,
solar@openwall.com
Subject: [kernel-hardening] Re: [PATCH RFC v3 6/7] proc: support new 'pids=all|ptraceable' mount option
Date: Fri, 10 Nov 2017 13:56:18 +1100 (AEDT) [thread overview]
Message-ID: <alpine.LFD.2.20.1711101356010.8844@localhost> (raw)
In-Reply-To: <1510244046-3256-7-git-send-email-tixxdz@gmail.com>
On Thu, 9 Nov 2017, Djalal Harouni wrote:
> This patch introduces the new 'pids' mount option, as it was discussed
> and suggested by Andy Lutomirski [1].
>
> * If 'pids=' is passed without 'newinstance' then it has no effect.
>
> * If 'newinstance,pids=all' then all processes will be shown in proc.
>
> * If 'newinstance,pids=ptraceable' then only ptraceable processes will be
> shown.
>
> * 'pids=' takes precendence over 'hidepid=' since 'hidepid=' can be
> ignored if "gid=" was set and caller has the "gid=" set in its groups.
> We want to guarantee that LSM have a security path there that can not
> be disabled with "gid=".
>
> This allows to support lightweight sandboxes in Embedded Linux.
>
> Later Yama LSM can be updated to check that processes are able only
> able to see their children inside /proc/, allowing to support more tight
> cases.
>
> [1] https://lkml.org/lkml/2017/4/26/646
>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Suggested-by: Andy Lutomirski <luto@kernel.org>
> Signed-off-by: Alexey Gladkov <gladkov.alexey@gmail.com>
> Signed-off-by: Djalal Harouni <tixxdz@gmail.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
--
James Morris
<james.l.morris@oracle.com>
WARNING: multiple messages have this Message-ID (diff)
From: James Morris <james.l.morris-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
To: Djalal Harouni <tixxdz-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Cc: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>,
Alexey Gladkov
<gladkov.alexey-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>,
Andy Lutomirski <luto-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>,
Andrew Morton
<akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>,
linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
kernel-hardening-ZwoEplunGu1jrUoiu81ncdBPR1lH4CV8@public.gmane.org,
linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
Greg Kroah-Hartman
<gregkh-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org>,
Alexander Viro
<viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org>,
Akinobu Mita
<akinobu.mita-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>,
me-xzjC0nNlxno@public.gmane.org,
Oleg Nesterov <oleg-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
Jeff Layton <jlayton-vpEMnDpepFuMZCB2o+C8xQ@public.gmane.org>,
Ingo Molnar <mingo-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>,
Alexey Dobriyan
<adobriyan-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>,
ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org,
Linus Torvalds
<torvalds-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>,
Daniel Micay
<danielmicay-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>,
Jonathan Corbet <corbet-T1hC0tSOHrs@public.gmane.org>,
bfields-uC3wQj2KruMpug/h7KTFAQ@public.gmane.org
Subject: Re: [PATCH RFC v3 6/7] proc: support new 'pids=all|ptraceable' mount option
Date: Fri, 10 Nov 2017 13:56:18 +1100 (AEDT) [thread overview]
Message-ID: <alpine.LFD.2.20.1711101356010.8844@localhost> (raw)
In-Reply-To: <1510244046-3256-7-git-send-email-tixxdz-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
On Thu, 9 Nov 2017, Djalal Harouni wrote:
> This patch introduces the new 'pids' mount option, as it was discussed
> and suggested by Andy Lutomirski [1].
>
> * If 'pids=' is passed without 'newinstance' then it has no effect.
>
> * If 'newinstance,pids=all' then all processes will be shown in proc.
>
> * If 'newinstance,pids=ptraceable' then only ptraceable processes will be
> shown.
>
> * 'pids=' takes precendence over 'hidepid=' since 'hidepid=' can be
> ignored if "gid=" was set and caller has the "gid=" set in its groups.
> We want to guarantee that LSM have a security path there that can not
> be disabled with "gid=".
>
> This allows to support lightweight sandboxes in Embedded Linux.
>
> Later Yama LSM can be updated to check that processes are able only
> able to see their children inside /proc/, allowing to support more tight
> cases.
>
> [1] https://lkml.org/lkml/2017/4/26/646
>
> Cc: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
> Cc: Greg Kroah-Hartman <gregkh-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org>
> Suggested-by: Andy Lutomirski <luto-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
> Signed-off-by: Alexey Gladkov <gladkov.alexey-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
> Signed-off-by: Djalal Harouni <tixxdz-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Reviewed-by: James Morris <james.l.morris-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
--
James Morris
<james.l.morris-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
WARNING: multiple messages have this Message-ID (diff)
From: james.l.morris@oracle.com (James Morris)
To: linux-security-module@vger.kernel.org
Subject: [PATCH RFC v3 6/7] proc: support new 'pids=all|ptraceable' mount option
Date: Fri, 10 Nov 2017 13:56:18 +1100 (AEDT) [thread overview]
Message-ID: <alpine.LFD.2.20.1711101356010.8844@localhost> (raw)
In-Reply-To: <1510244046-3256-7-git-send-email-tixxdz@gmail.com>
On Thu, 9 Nov 2017, Djalal Harouni wrote:
> This patch introduces the new 'pids' mount option, as it was discussed
> and suggested by Andy Lutomirski [1].
>
> * If 'pids=' is passed without 'newinstance' then it has no effect.
>
> * If 'newinstance,pids=all' then all processes will be shown in proc.
>
> * If 'newinstance,pids=ptraceable' then only ptraceable processes will be
> shown.
>
> * 'pids=' takes precendence over 'hidepid=' since 'hidepid=' can be
> ignored if "gid=" was set and caller has the "gid=" set in its groups.
> We want to guarantee that LSM have a security path there that can not
> be disabled with "gid=".
>
> This allows to support lightweight sandboxes in Embedded Linux.
>
> Later Yama LSM can be updated to check that processes are able only
> able to see their children inside /proc/, allowing to support more tight
> cases.
>
> [1] https://lkml.org/lkml/2017/4/26/646
>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Suggested-by: Andy Lutomirski <luto@kernel.org>
> Signed-off-by: Alexey Gladkov <gladkov.alexey@gmail.com>
> Signed-off-by: Djalal Harouni <tixxdz@gmail.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
--
James Morris
<james.l.morris@oracle.com>
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
WARNING: multiple messages have this Message-ID (diff)
From: James Morris <james.l.morris@oracle.com>
To: Djalal Harouni <tixxdz@gmail.com>
Cc: Kees Cook <keescook@chromium.org>,
Alexey Gladkov <gladkov.alexey@gmail.com>,
Andy Lutomirski <luto@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-hardening@lists.openwall.com,
linux-security-module@vger.kernel.org, linux-api@vger.kernel.org,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Akinobu Mita <akinobu.mita@gmail.com>,
me@tobin.cc, Oleg Nesterov <oleg@redhat.com>,
Jeff Layton <jlayton@poochiereds.net>,
Ingo Molnar <mingo@kernel.org>,
Alexey Dobriyan <adobriyan@gmail.com>,
ebiederm@xmission.com,
Linus Torvalds <torvalds@linux-foundation.org>,
Daniel Micay <danielmicay@gmail.com>,
Jonathan Corbet <corbet@lwn.net>,
bfields@fieldses.org, Stephen Rothwell <sfr@canb.auug.org.au>,
solar@openwall.com
Subject: Re: [PATCH RFC v3 6/7] proc: support new 'pids=all|ptraceable' mount option
Date: Fri, 10 Nov 2017 13:56:18 +1100 (AEDT) [thread overview]
Message-ID: <alpine.LFD.2.20.1711101356010.8844@localhost> (raw)
In-Reply-To: <1510244046-3256-7-git-send-email-tixxdz@gmail.com>
On Thu, 9 Nov 2017, Djalal Harouni wrote:
> This patch introduces the new 'pids' mount option, as it was discussed
> and suggested by Andy Lutomirski [1].
>
> * If 'pids=' is passed without 'newinstance' then it has no effect.
>
> * If 'newinstance,pids=all' then all processes will be shown in proc.
>
> * If 'newinstance,pids=ptraceable' then only ptraceable processes will be
> shown.
>
> * 'pids=' takes precendence over 'hidepid=' since 'hidepid=' can be
> ignored if "gid=" was set and caller has the "gid=" set in its groups.
> We want to guarantee that LSM have a security path there that can not
> be disabled with "gid=".
>
> This allows to support lightweight sandboxes in Embedded Linux.
>
> Later Yama LSM can be updated to check that processes are able only
> able to see their children inside /proc/, allowing to support more tight
> cases.
>
> [1] https://lkml.org/lkml/2017/4/26/646
>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Suggested-by: Andy Lutomirski <luto@kernel.org>
> Signed-off-by: Alexey Gladkov <gladkov.alexey@gmail.com>
> Signed-off-by: Djalal Harouni <tixxdz@gmail.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
--
James Morris
<james.l.morris@oracle.com>
next prev parent reply other threads:[~2017-11-10 2:56 UTC|newest]
Thread overview: 69+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-09 16:13 [kernel-hardening] [PATCH RFC v3 0/7] proc: modernize proc to support multiple private instances Djalal Harouni
2017-11-09 16:13 ` Djalal Harouni
2017-11-09 16:13 ` Djalal Harouni
2017-11-09 16:14 ` [kernel-hardening] [PATCH RFC v3 1/7] proc: add proc_fs_info struct to store proc information Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-10 10:26 ` [kernel-hardening] " Alexey Dobriyan
2017-11-10 10:26 ` Alexey Dobriyan
2017-11-10 10:26 ` Alexey Dobriyan
2017-11-10 10:26 ` Alexey Dobriyan
2017-11-10 10:32 ` [kernel-hardening] " Djalal Harouni
2017-11-10 10:32 ` Djalal Harouni
2017-11-10 10:32 ` Djalal Harouni
2017-11-10 10:32 ` Djalal Harouni
2017-11-09 16:14 ` [kernel-hardening] [PATCH RFC v3 2/7] proc: move /proc/{self|thread-self} dentries to proc_fs_info Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-10 10:31 ` [kernel-hardening] " Alexey Dobriyan
2017-11-10 10:31 ` Alexey Dobriyan
2017-11-10 10:31 ` Alexey Dobriyan
2017-11-10 10:31 ` Alexey Dobriyan
2017-11-10 10:45 ` [kernel-hardening] " Djalal Harouni
2017-11-10 10:45 ` Djalal Harouni
2017-11-10 10:45 ` Djalal Harouni
2017-11-10 10:45 ` Djalal Harouni
2017-11-09 16:14 ` [kernel-hardening] [PATCH RFC v3 3/7] proc: add helpers to set and get proc hidepid and gid mount options Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-10 10:36 ` [kernel-hardening] " Alexey Dobriyan
2017-11-10 10:36 ` Alexey Dobriyan
2017-11-10 10:36 ` Alexey Dobriyan
2017-11-10 10:36 ` Alexey Dobriyan
2017-11-10 10:41 ` [kernel-hardening] " Djalal Harouni
2017-11-10 10:41 ` Djalal Harouni
2017-11-10 10:41 ` Djalal Harouni
2017-11-10 10:41 ` Djalal Harouni
2017-11-09 16:14 ` [kernel-hardening] [PATCH RFC v3 4/7] proc: support mounting private procfs instances inside same pid namespace Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-10 2:53 ` [kernel-hardening] " James Morris
2017-11-10 2:53 ` James Morris
2017-11-10 2:53 ` James Morris
2017-11-10 2:53 ` James Morris
2017-11-10 10:33 ` [kernel-hardening] " Djalal Harouni
2017-11-10 10:33 ` Djalal Harouni
2017-11-10 10:33 ` Djalal Harouni
2017-11-10 10:33 ` Djalal Harouni
2017-11-09 16:14 ` [kernel-hardening] [PATCH RFC v3 5/7] proc: move hidepid definitions to proc files Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-09 16:14 ` [kernel-hardening] [PATCH RFC v3 6/7] proc: support new 'pids=all|ptraceable' mount option Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-10 2:38 ` [kernel-hardening] " Andy Lutomirski
2017-11-10 2:38 ` Andy Lutomirski
2017-11-10 2:38 ` Andy Lutomirski
2017-11-10 2:38 ` Andy Lutomirski
2017-11-10 10:38 ` [kernel-hardening] " Djalal Harouni
2017-11-10 10:38 ` Djalal Harouni
2017-11-10 10:38 ` Djalal Harouni
2017-11-10 10:38 ` Djalal Harouni
2017-11-10 2:56 ` James Morris [this message]
2017-11-10 2:56 ` James Morris
2017-11-10 2:56 ` James Morris
2017-11-10 2:56 ` James Morris
2017-11-09 16:14 ` [kernel-hardening] [PATCH RFC v3 7/7] proc: flush dcache entries from all procfs instances Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
2017-11-09 16:14 ` Djalal Harouni
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.LFD.2.20.1711101356010.8844@localhost \
--to=james.l.morris@oracle.com \
--cc=adobriyan@gmail.com \
--cc=akinobu.mita@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=bfields@fieldses.org \
--cc=corbet@lwn.net \
--cc=danielmicay@gmail.com \
--cc=ebiederm@xmission.com \
--cc=gladkov.alexey@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=jlayton@poochiereds.net \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=luto@kernel.org \
--cc=me@tobin.cc \
--cc=mingo@kernel.org \
--cc=oleg@redhat.com \
--cc=sfr@canb.auug.org.au \
--cc=solar@openwall.com \
--cc=tixxdz@gmail.com \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.