Re: [RFC][PATCH v3] Unprivileged: Disable raising of privileges

[ebiederm@xmission.com (Eric W. Biederman)]

Alan Cox <alan@lxorguk.ukuu.org.uk> writes:

> On Wed, 30 Dec 2009 13:36:57 -0800
> ebiederm@xmission.com (Eric W. Biederman) wrote:
>
>> Alan Cox <alan@lxorguk.ukuu.org.uk> writes:
>> 
>> >> Added bprm->nosuid to make remove the need to add
>> >> duplicate error prone checks.  This ensures that
>> >> the disabling of suid executables is exactly the
>> >> same as MNT_NOSUID.
>> >
>> > Another fine example of why we have security hooks so that we don't get a
>> > kernel full of other "random security idea of the day" hacks.
>> 
>> Well it comes from plan 9.  Except there they just simply did not
>> implement suid.  What causes you to think dropping the ability
>> to execute suid executables is a random security idea of the day?
>
> Well to be fair its random regurgitated security idea of every year or
> two.
>
> More to the point - we have security_* hooks so this kind of continuous
> security proposal turdstream can stay out of the main part of the kernel.
>
> Cleaning up the mechanism by which NOSUID is handled in kernel seems a
> good idea. Adding wacky new prctls and gunk for it doesn't, and belongs
> in whatever security model you are using via the security hooks.

I am more than happy to make this a proper system call, instead of a
prctl.  The way this code is evolving that seems to be the clean way
to handle this.  No point in hiding the functionality away in a corner
in shame.

In my book SUID applications are the root of all evil.  They are
exploitable if you twist their environment in a way they have not
hardened themselves against, and simply supporting them prevents a lot
of good features from being used by ordinary applications.

To get SUID out of my way I have to do something.  A disable SUID
from this process and it's children is a simple and direct way there.
My other path is much more complicated.

As this also has security related uses it seems even better as a feature.

Eric