From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754000Ab1KGT4e (ORCPT ); Mon, 7 Nov 2011 14:56:34 -0500 Received: from mail-bw0-f46.google.com ([209.85.214.46]:62545 "EHLO mail-bw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752774Ab1KGT4c (ORCPT ); Mon, 7 Nov 2011 14:56:32 -0500 Date: Mon, 7 Nov 2011 23:54:28 +0400 From: Vasiliy Kulikov To: Eric Paris Cc: kernel-hardening@lists.openwall.com, Valdis.Kletnieks@vt.edu, linux-kernel@vger.kernel.org, Alexey Dobriyan , Andrew Morton , linux-security-module@vger.kernel.org, Linus Torvalds Subject: Re: [kernel-hardening] Re: [PATCH] proc: restrict access to /proc/interrupts Message-ID: <20111107195428.GA5362@albatros> References: <20111107174522.GA2317@albatros> <9718.1320689192@turing-police.cc.vt.edu> <20111107190112.GA3732@albatros> <4EB82F08.8060209@zytor.com> <20111107192915.GA4690@albatros> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.5.20 (2009-06-14) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Nov 07, 2011 at 14:48 -0500, Eric Paris wrote: > On Mon, Nov 7, 2011 at 2:29 PM, Vasiliy Kulikov wrote: > > On Mon, Nov 07, 2011 at 11:18 -0800, H. Peter Anvin wrote: > > > As to procfs, I see no real need of adding mode/group mount option for > > global procfs files (/proc/interrupts, /proc/stat, etc.) - it can be > > done by distro specific init scripts (chown+chmod).  I don't mind > > against such an option for the convenience, though. > > While possible, the chmod+chown 'solutions' just aren't as simple as > you pretend. Every time one creates a chroot environment and mounts > /proc it has be manually fixed there as well. Same thing with a > container. I admit I don't fully realize all possible containers' uses, but doesn't procfs is mounted inside of containers for only restricted full-featured Linux distros usermods with the whole init and init scripts set? I didn't see any consistent usages of procfs for other things, do they exist? Creating separate namespaces is very useful for additional daemon restrictions like vsftpd does it, but procfs inside of such namespace is obviously denied by design ;) And as procfs is a one instance per pid namespace, it has the same permissions in all mount points, so I see no problem with chroot (however, I find chroot not very useful with procfs inside). Thanks, -- Vasiliy Kulikov http://www.openwall.com - bringing security into open computing environments