From: "Theodore Y. Ts'o" <tytso@mit.edu>
To: Alan Cox <gnomes@lxorguk.ukuu.org.uk>
Cc: Dave Chinner <david@fromorbit.com>, TongZhang <ztong@vt.edu>,
darrick.wong@oracle.com, linux-xfs@vger.kernel.org,
LKML <linux-kernel@vger.kernel.org>,
linux-security-module@vger.kernel.org,
Wenbo Shen <shenwenbosmile@gmail.com>
Subject: Re: Leaking Path in XFS's ioctl interface(missing LSM check)
Date: Mon, 1 Oct 2018 11:25:29 -0400 [thread overview]
Message-ID: <20181001152529.GA2549@thunk.org> (raw)
In-Reply-To: <20181001160442.47c798bc@alans-desktop>
On Mon, Oct 01, 2018 at 04:04:42PM +0100, Alan Cox wrote:
> > Systems restricted by LSMs to the point where CAP_SYS_ADMIN is not
> > trusted have exactly the same issues. i.e. there's nobody trusted by
> > the kernel to administer the storage stack, and nobody has defined a
> > workable security model that can prevent untrusted users from
> > violating the existing storage trust model....
>
> With a proper set of LSM checks you can lock the filesystem management
> and enforcement to a particular set of objects. You can build that model
> where for example only an administrative login from a trusted console may
> launch processes to do that management.
>
> Or you could - if things were not going around the LSM hooks.
It would be useful if anyone actually *wants* to do this thing to
define a formal security model, and detail *everything* that would
need to be changed in order to accomplish it. Just as we don't
speculatively add code "just in case" someone might want to use it
someday, I don't think we should be adding random LSM hooks just
becausre someone *might* want do something.
Let's see the use case, and let's see how horrible the changes would
need to be, and how credible we think it is that someone will actually
want to *use* it. I suspect the chagnes will be a really huge number
of places, and not just in XFS....
- Ted
next prev parent reply other threads:[~2018-10-01 22:03 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-26 0:51 Leaking Path in XFS's ioctl interface(missing LSM check) TongZhang
2018-09-26 1:33 ` Dave Chinner
2018-09-26 13:23 ` Stephen Smalley
2018-09-27 2:08 ` Dave Chinner
2018-09-26 18:24 ` Alan Cox
2018-09-27 1:38 ` Dave Chinner
2018-09-27 21:23 ` James Morris
2018-09-27 22:19 ` Dave Chinner
2018-09-27 23:12 ` Tetsuo Handa
2018-09-30 14:16 ` Alan Cox
2018-10-01 0:25 ` Dave Chinner
2018-10-01 15:04 ` Alan Cox
2018-10-01 15:25 ` Theodore Y. Ts'o [this message]
2018-10-01 22:53 ` Dave Chinner
2018-10-01 15:44 ` Darrick J. Wong
2018-10-01 20:08 ` James Morris
2018-10-01 22:45 ` Dave Chinner
2018-10-02 19:20 ` James Morris
2018-10-02 22:42 ` Dave Chinner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181001152529.GA2549@thunk.org \
--to=tytso@mit.edu \
--cc=darrick.wong@oracle.com \
--cc=david@fromorbit.com \
--cc=gnomes@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-xfs@vger.kernel.org \
--cc=shenwenbosmile@gmail.com \
--cc=ztong@vt.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).