Re: [PATCH v5 2/4] fuse: Support fuse filesystems outside of init_user_ns

[Seth Forshee <seth.forshee@canonical.com>]

On Tue, Nov 11, 2014 at 03:04:54PM +0100, Miklos Szeredi wrote:
> On Wed, Oct 22, 2014 at 04:24:18PM -0500, Seth Forshee wrote:
> > Update fuse to translate uids and gids to/from the user namspace
> > of the process servicing requests on /dev/fuse. Any ids which do
> > not map into the namespace will result in errors. inodes will
> > also be marked bad when unmappable ids are received from
> > userspace.
> 
> Okay.
> 
> > Due to security concerns the namespace used should be fixed,
> > otherwise a user might be able to gain elevated privileges or
> > influence processes that the user would otherwise be unable to
> > manipulate. Thus the namespace of the mounting process is used
> > for all translations, and this namespace is required to be the
> > same as the one in use when /dev/fuse was opened.
> 
> Maybe I'm being dense, but can someone give a concrete example of such an
> attack?

I'm repeating myself, but the only specific example I'm aware of is the
suid example with is prevented by other mechanisms (both in fuse and in
Andy's proposed patch). Perhaps Eric or Andy could give examples of
other potential problems, and I'll also see what I can come up with.

> That might also help me understand how exactly user/pid namespaces work...
> 
> Patch otherwise looks okay.

Great, thanks for the review.

Seth

> 
> Thanks,
> Miklos