From mboxrd@z Thu Jan 1 00:00:00 1970 From: Al Viro Subject: Re: Connecting to sockets on MNT_READONLY mounts? Date: Fri, 2 May 2014 01:56:59 +0100 Message-ID: <20140502005659.GF18016@ZenIV.linux.org.uk> References: <20140501223432.GD18016@ZenIV.linux.org.uk> <20140501235135.GE18016@ZenIV.linux.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Linux FS Devel , "linux-kernel@vger.kernel.org" , Network Development To: Andy Lutomirski Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Thu, May 01, 2014 at 04:57:13PM -0700, Andy Lutomirski wrote: > Suppose I bind-mount /usr into a private namespace with > nosuid,nodev,ro. How can you use it to attack anything? The only > thing I've thought of is to open fifos and connect to sockets. I'm > assuming that there's a pid namespace blocking ptrace and such and a > network namespace blocking abstract sockets. How many FIFOs and sockets are there in your /usr? Here all I see outside of /dev, /run and /tmp (across seven boxen; I can check more, but I really doubt it'll catch anything) is the grand total of 4: /lib/cryptsetup/passfifo /var/lib/oprofile/opd_pipe /var/lib/nfs/rpc_pipefs/nfs/clnt0/idmap /var/lib/nfs/rpc_pipefs/gssd/clntXX/gssd None of those in /usr and I don't believe that you seriously propose to bind e.g. /lib/cryptsetup into your sandbox. And while we are at it, exposing host /usr is *not* a good idea - if nothing else, it gives quite a bit of information about the versions of software installed on the host. Ability to watch atime of /usr/bin/* also might be interesting, etc. Do you, by any chance, plan to expose the host /tmp or /run? Or rpc_pipefs, for that matter...