From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753093AbbGHXsw (ORCPT ); Wed, 8 Jul 2015 19:48:52 -0400 Received: from mail-la0-f42.google.com ([209.85.215.42]:34132 "EHLO mail-la0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751299AbbGHXsn (ORCPT ); Wed, 8 Jul 2015 19:48:43 -0400 MIME-Version: 1.0 In-Reply-To: References: <1436172445-6979-1-git-send-email-avagin@openvz.org> <20150707154345.GA1593@odin.com> <20150708161022.GA1705@odin.com> From: Andy Lutomirski Date: Wed, 8 Jul 2015 16:48:22 -0700 Message-ID: Subject: Re: [PATCH 0/24] kernel: add a netlink interface to get information about processes (v2) To: Andrey Vagin Cc: Andrew Vagin , "linux-kernel@vger.kernel.org" , Linux API , Oleg Nesterov , Andrew Morton , Cyrill Gorcunov , Pavel Emelyanov , Roger Luethi , Arnd Bergmann , Arnaldo Carvalho de Melo , David Ahern , Pavel Odintsov Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Jul 8, 2015 at 3:49 PM, Andrey Vagin wrote: > 2015-07-08 20:39 GMT+03:00 Andy Lutomirski : >> On Wed, Jul 8, 2015 at 9:10 AM, Andrew Vagin wrote: >>> >>> As far as I understand, socket_diag doesn't have this problem, becaus >>> each socket has a link on a namespace where it was created. >>> >>> What if we will pin the current pidns and credentials to a task_diag >>> socket in a moment when it's created. >> >> That's certainly doable. OTOH, if anything does: >> >> socket(AF_NETLINK, ...); >> unshare(CLONE_PID); >> fork(); >> >> then they now have a (minor) security problem. > > What do you mean? Is it not the same when we open a file and change > uid and gid? Permissions are checked only in the "open" syscall. > > [root@avagin-fc19-cr ~]# ls -l xxx > -rw-r--r-- 1 root root 5 Jul 9 01:42 xxx > > open("xxx", O_WRONLY|O_APPEND) = 3 > setgid(1000) = 0 > setuid(1000) = 0 > write(3, "a", 1) = 1 > close(1) = 0 Yes and no. open(2) is supposed to return an fd that retains the access to the file that existed when open(2) was called. socket(2) is supposed* to capture the access to the netns that existed at the time it was called, but capturing access to a userns and/or pidns is new. If you added socket(AF_NETLINK, SOCK_DGRAM, NETLINK_PIDNS), then maybe that would work, but the userns interaction is a bit odd. OTOH every pidns has an associated userns, so you could just use that. I don't know whether that would annoy someone. * There's some question as to whether socket(2) or connect(2) should do this, but connect handling in netlink is quite broken and iproute2 relies on the broken handling. The historical behavior was different, too, but the old behavior was exploitable. I have a cute little program that does 'ip set dev lo down' but doesn't need to be run as root :) --Andy From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Lutomirski Subject: Re: [PATCH 0/24] kernel: add a netlink interface to get information about processes (v2) Date: Wed, 8 Jul 2015 16:48:22 -0700 Message-ID: References: <1436172445-6979-1-git-send-email-avagin@openvz.org> <20150707154345.GA1593@odin.com> <20150708161022.GA1705@odin.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Return-path: In-Reply-To: Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Andrey Vagin Cc: Andrew Vagin , "linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , Linux API , Oleg Nesterov , Andrew Morton , Cyrill Gorcunov , Pavel Emelyanov , Roger Luethi , Arnd Bergmann , Arnaldo Carvalho de Melo , David Ahern , Pavel Odintsov List-Id: linux-api@vger.kernel.org On Wed, Jul 8, 2015 at 3:49 PM, Andrey Vagin wrote: > 2015-07-08 20:39 GMT+03:00 Andy Lutomirski : >> On Wed, Jul 8, 2015 at 9:10 AM, Andrew Vagin wrote: >>> >>> As far as I understand, socket_diag doesn't have this problem, becaus >>> each socket has a link on a namespace where it was created. >>> >>> What if we will pin the current pidns and credentials to a task_diag >>> socket in a moment when it's created. >> >> That's certainly doable. OTOH, if anything does: >> >> socket(AF_NETLINK, ...); >> unshare(CLONE_PID); >> fork(); >> >> then they now have a (minor) security problem. > > What do you mean? Is it not the same when we open a file and change > uid and gid? Permissions are checked only in the "open" syscall. > > [root@avagin-fc19-cr ~]# ls -l xxx > -rw-r--r-- 1 root root 5 Jul 9 01:42 xxx > > open("xxx", O_WRONLY|O_APPEND) = 3 > setgid(1000) = 0 > setuid(1000) = 0 > write(3, "a", 1) = 1 > close(1) = 0 Yes and no. open(2) is supposed to return an fd that retains the access to the file that existed when open(2) was called. socket(2) is supposed* to capture the access to the netns that existed at the time it was called, but capturing access to a userns and/or pidns is new. If you added socket(AF_NETLINK, SOCK_DGRAM, NETLINK_PIDNS), then maybe that would work, but the userns interaction is a bit odd. OTOH every pidns has an associated userns, so you could just use that. I don't know whether that would annoy someone. * There's some question as to whether socket(2) or connect(2) should do this, but connect handling in netlink is quite broken and iproute2 relies on the broken handling. The historical behavior was different, too, but the old behavior was exploitable. I have a cute little program that does 'ip set dev lo down' but doesn't need to be run as root :) --Andy