From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) Subject: Re: [CFT][PATCH 7/8] userns: Add a knob to disable setgroups on a per user namespace basis Date: Wed, 10 Dec 2014 16:33:26 -0600 Message-ID: <87wq5zf83t.fsf@x220.int.ebiederm.org> References: <52e0643bd47b1e5c65921d6e00aea1f724bb510a.1417281801.git.luto@amacapital.net> <87fvcxyf28.fsf_-_@x220.int.ebiederm.org> <874mtdyexp.fsf_-_@x220.int.ebiederm.org> <87a935u3nj.fsf@x220.int.ebiederm.org> <87388xodlj.fsf@x220.int.ebiederm.org> <87h9x5re41.fsf_-_@x220.int.ebiederm.org> <87mw6xpzb0.fsf_-_@x220.int.ebiederm.org> <87ppbtn4mv.fsf@x220.int.ebiederm.org> <87a92xn2io.fsf@x220.int.ebiederm.org> <87r3w8liw4.fsf@x220.int.ebiederm.org> <87iohklfvj.fsf_-_@x220.int.ebiederm.org> <87fvcok11h.fsf_-_@x220.int.ebiederm.org> <971ad3f6-90fd-4e3f-916c-8988af3c826d@email.android.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: (Andy Lutomirski's message of "Tue, 9 Dec 2014 16:21:23 -0800") List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Andy Lutomirski Cc: linux-man , Kees Cook , Linux API , Linux Containers , Josh Triplett , stable , "linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , Kenton Varda , LSM , Michael Kerrisk-manpages , Richard Weinberger , Casey Schaufler , Andrew Morton List-Id: linux-man@vger.kernel.org Andy Lutomirski writes: > On Tue, Dec 9, 2014 at 4:04 PM, Eric W.Biederman wrote: >> >> >> On December 9, 2014 4:28:38 PM CST, Andy Lutomirski wrote: >>>On Tue, Dec 9, 2014 at 12:42 PM, Eric W. Biederman >>> wrote: >>>> >>>> - Expose the knob to user space through a proc file >>>/proc//setgroups >>>> >>>> A value of "deny" means the setgroups system call is disabled in >>>the >>>> current processes user namespace and can not be enabled in the >>>> future in this user namespace. >>>> >>>> A value of "allow" means the segtoups system call is enabled. >>>> >>>> - Descendant user namespaces inherit the value of setgroups from >>>> their parents. >>>> >>>> - A proc file is used (instead of a sysctl) as sysctls >>>> currently do not pass in a struct file so file_ns_capable >>>> is unusable. >>> >>>Reviewed-by: Andy Lutomirski >>> >>>But I still don't like the name "setgroups". People may look at that >>>and have no clue what the scope of the setting is. And anyone who, as >>>root, writes "deny" to /proc/self/setgroups, thinking that it acts on >>>self, will be in for a surprise. >> >> True setgroups isn't perfect. Documenting it in a manpage may have to be enough. The only real improvement I can think of would be to make the setting a sysctl. But I think pursuing that approaches the point where perfection is the enemy of getting this problem fixed. >> > > Would "userns_setgroups" be okay? Maybe. I just played with this and this is a much bigger booby trap than I had realized. Disabling setgroups disables the possibility of logging in the future and since it is a one way switch the only way out is to reboot. Hooray our software checks the returns of setgroups. Booh. This is a really nasty knob to have anywhere. I need to think about this a little bit. Giving root the power to shoot himself in the foot is one thing. Giving root a loaded gun pointed at his foot with the hammer pulled back, and a sign that says I dare you to pull the trigger, seems like a bad idea. I think I need to reduce when that knob can be used. Grr. Back to the drawing board! Eric