From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752625AbcJSV2w (ORCPT ); Wed, 19 Oct 2016 17:28:52 -0400 Received: from out03.mta.xmission.com ([166.70.13.233]:46193 "EHLO out03.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750823AbcJSV2t (ORCPT ); Wed, 19 Oct 2016 17:28:49 -0400 From: ebiederm@xmission.com (Eric W. Biederman) To: Andy Lutomirski Cc: Jann Horn , Michal Hocko , "linux-kernel\@vger.kernel.org" , Linux Containers , Oleg Nesterov , "linux-mm\@kvack.org" , Linux FS Devel References: <87twcbq696.fsf@x220.int.ebiederm.org> <20161018135031.GB13117@dhcp22.suse.cz> <8737jt903u.fsf@xmission.com> <20161018150507.GP14666@pc.thejh.net> <87twc9656s.fsf@xmission.com> <20161018191206.GA1210@laptop.thejh.net> <87r37dnz74.fsf@xmission.com> <87k2d5nytz.fsf_-_@xmission.com> <87y41kjn6l.fsf@xmission.com> <20161019172917.GE1210@laptop.thejh.net> <87pomwi5p2.fsf@xmission.com> Date: Wed, 19 Oct 2016 16:26:41 -0500 In-Reply-To: (Andy Lutomirski's message of "Wed, 19 Oct 2016 11:38:18 -0700") Message-ID: <87pomwghda.fsf@xmission.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1bwyPn-0000Xp-T9;;;mid=<87pomwghda.fsf@xmission.com>;;;hst=in02.mta.xmission.com;;;ip=75.170.125.99;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1+Mkxyp/awcExUCjimUGO6EJ/SDY9MXxOk= X-SA-Exim-Connect-IP: 75.170.125.99 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.7 XMSubLong Long Subject * 1.5 TR_Symld_Words too many words that have symbols inside * 0.0 TVD_RCVD_IP Message was received from an IP address * 0.0 T_TM2_M_HEADER_IN_MSG BODY: No description available. * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.5000] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa06 1397; Body=1 Fuz1=1 Fuz2=1] * 0.5 XM_Body_Dirty_Words Contains a dirty word * 0.0 T_TooManySym_01 4+ unique symbols in subject X-Spam-DCC: XMission; sa06 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: **;Andy Lutomirski X-Spam-Relay-Country: X-Spam-Timing: total 309 ms - load_scoreonly_sql: 0.04 (0.0%), signal_user_changed: 3.5 (1.1%), b_tie_ro: 2.5 (0.8%), parse: 1.16 (0.4%), extract_message_metadata: 19 (6.0%), get_uri_detail_list: 2.9 (0.9%), tests_pri_-1000: 9 (2.8%), tests_pri_-950: 1.16 (0.4%), tests_pri_-900: 0.99 (0.3%), tests_pri_-400: 30 (9.7%), check_bayes: 29 (9.4%), b_tokenize: 9 (2.9%), b_tok_get_all: 10 (3.2%), b_comp_prob: 3.2 (1.0%), b_tok_touch_all: 4.1 (1.3%), b_finish: 1.15 (0.4%), tests_pri_0: 237 (76.5%), check_dkim_signature: 0.51 (0.2%), check_dkim_adsp: 6 (1.9%), tests_pri_500: 5 (1.7%), rewrite_mail: 0.00 (0.0%) Subject: Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Andy Lutomirski writes: > On Wed, Oct 19, 2016 at 10:55 AM, Eric W. Biederman > wrote: >> Andy Lutomirski writes: >> >>> On Wed, Oct 19, 2016 at 10:29 AM, Jann Horn wrote: >>>> On Wed, Oct 19, 2016 at 11:52:50AM -0500, Eric W. Biederman wrote: >>>>> Andy Lutomirski writes: >>>>> > Simply ptrace yourself, exec the >>>>> > program, and then dump the program out. A program that really wants >>>>> > to be unreadable should have a stub: the stub is setuid and readable, >>>>> > but all the stub does is to exec the real program, and the real >>>>> > program should have mode 0500 or similar. >>>>> > >>>>> > ISTM the "right" check would be to enforce that the program's new >>>>> > creds can read the program, but that will break backwards >>>>> > compatibility. >>>>> >>>>> Last I looked I had the impression that exec of a setuid program kills >>>>> the ptrace. >>>>> >>>>> If we are talking about a exec of a simple unreadable executable (aka >>>>> something that sets undumpable but is not setuid or setgid). Then I >>>>> agree it should break the ptrace as well and since those programs are as >>>>> rare as hens teeth I don't see any problem with changing the ptrace behavior >>>>> in that case. >>>> >>>> Nope. check_unsafe_exec() sets LSM_UNSAFE_* flags in bprm->unsafe, and then >>>> the flags are checked by the LSMs and cap_bprm_set_creds() in commoncap.c. >>>> cap_bprm_set_creds() just degrades the execution to a non-setuid-ish one, >>>> and e.g. ptracers stay attached. >>> >>> I think you're right. I ought to be completely sure because I rewrote >>> that code back in 2005 or so back when I thought kernel programming >>> was only for the cool kids. It was probably my first kernel patch >>> ever and it closed an awkward-to-exploit root hole. But it's been a >>> while. (Too bad my second (IIRC) kernel patch was more mundane and >>> fixed the mute button on "new" Lenovo X60-era laptops and spend >>> several years in limbo...) >> >> Ah yes and this is only a problem if the ptracer does not have >> CAP_SYS_PTRACE. >> >> If the tracer does not have sufficient permissions any opinions on >> failing the exec or kicking out the ptracer? I am leaning towards failing >> the exec as it is more obvious if someone cares. Dropping the ptracer >> could be a major mystery. > > I would suggest leaving it alone. Changing it could break enough > things that a sysctl would be needed, and I just don't see how this is > a significant issue, especially since it's been insecure forever. > Anyone who cares should do the stub executable trick: > > /sbin/foo: 04755, literally just does execve("/sbin/foo-helper"); > > /sbin/foo-helper: 0500. I can't imagine what non-malware would depend on being able to circumvent file permissions and ptrace a read-only executable. Is there something you are thinking of? I know I saw someone depending on read-only executables being read-only earlier this week on the security list, and it could definitely act as part of a counter measure to make binaries harder to exploit. So given that people actually expect no-read permissions to be honored on executables (with what seem valid and sensible use cases), that I can't see any valid reason not to honor no-read permissions, that it takes a really convoluted setup to bypass the current no-read permissions, and that I can't believe anyone cares about the current behavior of ptrace I think this is worth fixing. Eric