Re: [RFC][PATCH] rbind across namespaces

Jamie Lokier
2005-05-24T18:16:34Z

Mike Waychison wrote:
> >No need to hijack, it's already done. Removing calls to
> >proc_check_root() will allow access to different namespaces detached
> >mounts, etc. It's been tried and actually works.
>
> See previous message as why we don't want to allow this.

If you can ptrace any process which is in another namespace, then you
_effectively_ have full access to that namespace. It's quite easy to
do, and negates the supposed security of namespaces.

Because of that, there's _no_ real security benefit from denying
access to /proc/NNN/fd/ if you are able to ptrace task NNN.

What I think makes sense is this:

1. Deny access to /proc/NNN/fd/, /proc/NNN/cwd, /proc/NNN/root
if task NNN cannot be ptraced.

3. Allow entry to /proc/NNN/fd/, /proc/NNN/cwd, /proc/NNN/root
if ptrace is allowed; the namespace being irrelevant.

3. Use _exactly_ the same condition as for ptracing,
i.e. MAY_PTRACE in fs/proc/base.c. Ensure that condition is
consistent with the tests in kernel/ptrace.c, possibly putting
the condition in a common header file to keep it consistent in
future.

4. If further restrictions are desired, to make namespaces more
strict, those should be implemented by further restrictions on
which tasks are allowed to ptrace other tasks.

-- Jamie