Re: [PATCH] [RFC] Make it easier to harden /proc/

[Richard Weinberger <richard@nod.at>]

Am Donnerstag 17 März 2011, 11:14:26 schrieb Miquel van Smoorenburg:
> On 16-03-11 10:15 PM, Alexey Dobriyan wrote:
> > On Wed, Mar 16, 2011 at 10:07:48PM +0100, Richard Weinberger wrote:
> >> Am Mittwoch 16 März 2011, 22:04:52 schrieb Alexey Dobriyan:
> >>> On Wed, Mar 16, 2011 at 09:52:49PM +0100, Richard Weinberger wrote:
> >>>> Am Mittwoch 16 März 2011, 21:45:45 schrieb Arnd Bergmann:
> >>>>> On Wednesday 16 March 2011 21:08:16 Richard Weinberger wrote:
> >>>>>> Am Mittwoch 16 März 2011, 20:55:49 schrieb Kees Cook:
> >>>>> I had expected that any dangerous sysctl would not be visible in
> >>>>> an unpriviledge container anyway.
> >>>> 
> >>>> No way.
> >>> 
> >>> No way what exactly?
> >> 
> >> Dangerous sysctls are not protected at all.
> >> E.g. A jailed root can use /proc/sysrq-trigger.
> > 
> > Yes, and it's suggested that you do not show it at all,
> > instead of bloaing ctl_table.
> > 
> > But this requires knowledge which /proc is root and which one is "root".
> > 
> > :-(
> > 
> > With current splitup into FOO_NS...
> 
> And what about sysfs, there's a lot of writable stuff there too. For
> example in /sys/module/*/parameters, /sys/block/*/device/queu ,
> /sys/kernel/, /sys/platform/ etc. Perhaps things you don't want to be
> read too, such as some uevent files.
> 
> Shouldn't that be made inaccessible as well, preferably not visible?

Sure.
It's the next big thing on my TODO list. :)

> Programs in containers may need sysfs for stuff like
> /sys/class/net/<device> , so just not mounting sysfs may not be an option.

In most cases mounting /sys read-only is sufficient.
Also in most of my cases no /sys is needed.

> Mike.