From mboxrd@z Thu Jan 1 00:00:00 1970 From: Seth Forshee Subject: Re: [PATCH v4 3/5] fuse: Restrict allow_other to uids already controlled by the user Date: Wed, 15 Oct 2014 17:11:00 +0200 Message-ID: <20141015151100.GA988@ubuntu-mba51> References: <1413296756-25071-1-git-send-email-seth.forshee@canonical.com> <1413296756-25071-4-git-send-email-seth.forshee@canonical.com> <543E8BB3.6040701@amacapital.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: Miklos Szeredi , fuse-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org, "Serge H. Hallyn" , LKML , "Eric W. Biederman" , linux-fsdevel To: Andy Lutomirski Return-path: Content-Disposition: inline In-Reply-To: <543E8BB3.6040701-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: fuse-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org List-Id: linux-fsdevel.vger.kernel.org On Wed, Oct 15, 2014 at 07:58:59AM -0700, Andy Lutomirski wrote: > On 10/14/2014 07:25 AM, Seth Forshee wrote: > > Unprivileged users are normally restricted from mounting with the > > allow_other option by system policy, but this could be bypassed > > for a mount done with user namespace root permissions. In such > > cases allow_other should not allow users outside the user > > namespace to access the mount as doing so would give the > > unprivileged user the ability to manipulate processes it would > > otherwise be unable to manipulate. > > What threat is this intended to protect against? I think that, if this > is needed, tasks outside the userns or its descendents should be > blocked, even if the user ids match. That is, I think you should check > the namespace, not the uid and gid. allow_other is an existing option in fuse to protect against DoS attacks against more privileged users by making file operations block indefinitely. So this change makes it work the same way inside a user namespace but only to users mapped into the namespace. Checking the namespace does seem to make more sense, so I'll make that change. Thanks, Seth ------------------------------------------------------------------------------ Comprehensive Server Monitoring with Site24x7. Monitor 10 servers for $9/Month. Get alerted through email, SMS, voice calls or mobile push notifications. Take corrective actions from your mobile device. http://p.sf.net/sfu/Zoho