From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755590AbcAWBAu (ORCPT ); Fri, 22 Jan 2016 20:00:50 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:33778 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753444AbcAWBAq (ORCPT ); Fri, 22 Jan 2016 20:00:46 -0500 Message-ID: <1453510799.3734.153.camel@decadent.org.uk> Subject: Re: [kernel-hardening] Re: [PATCH 2/2] sysctl: allow CLONE_NEWUSER to be disabled From: Ben Hutchings To: kernel-hardening@lists.openwall.com, Robert =?UTF-8?Q?=C5=9Awi=C4=99cki?= , "Serge E. Hallyn" Cc: Andrew Morton , Al Viro , Richard Weinberger , "Eric W. Biederman" , Andy Lutomirski , Dmitry Vyukov , David Howells , Kostya Serebryany , Alexander Potapenko , Eric Dumazet , Sasha Levin , "linux-doc@vger.kernel.org" , LKML Date: Sat, 23 Jan 2016 00:59:59 +0000 In-Reply-To: References: <1453502345-30416-1-git-send-email-keescook@chromium.org> <1453502345-30416-3-git-send-email-keescook@chromium.org> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-b1ax81mfbcfld+vwSseD" X-Mailer: Evolution 3.18.3-1 Mime-Version: 1.0 X-SA-Exim-Connect-IP: 192.168.4.247 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --=-b1ax81mfbcfld+vwSseD Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, 2016-01-22 at 15:00 -0800, Kees Cook wrote: > On Fri, Jan 22, 2016 at 2:55 PM, Robert =C5=9Awi=C4=99cki wrote: > > 2016-01-22 23:50 GMT+01:00 Kees Cook : > >=20 > > > > Seems that Debian and some older Ubuntu versions are already using > > > >=20 > > > > $ sysctl -a | grep usern > > > > kernel.unprivileged_userns_clone =3D 0 > > > >=20 > > > > Shall we be consistent wit it? > > >=20 > > > Oh! I didn't see that on systems I checked. On which version did you = find that? > >=20 > > $ uname -a > > Linux bc1 4.3.0-0.bpo.1-amd64 #1 SMP Debian 4.3.3-5~bpo8+1 > > (2016-01-07) x86_64 GNU/Linux > > $ cat /etc/debian_version > > 8.2 >=20 > Ah-ha, Debian only, though it looks like this was just committed to > the Ubuntu kernel tree too: >=20 >=20 > > IIRC some older kernels delivered with Ubuntu Precise were also using > > it (but maybe I'm mistaken) >=20 > I don't see it there. >=20 > I think my patch is more complete, but I'm happy to change the name if > this sysctl has already started to enter the global consciousness. ;) >=20 > Serge, Ben, what do you think? I agree that using the '_restrict' suffix for new restrictions makes sense. =C2=A0I also don't think that a third possible value for kernel.unprivileged_userns_clone would would be understandable. I would probably make kernel.unprivileged_userns_clone a wrapper for kernel.userns_restrict in Debian, then deprecate and eventually remove it. Ben. --=20 Ben Hutchings Life is what happens to you while you're busy making other plans. - John Lenno= n --=-b1ax81mfbcfld+vwSseD Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUAVqLQj+e/yOyVhhEJAQphXA/9FMO8e5N8fSfEopqbG0eutRAUWsCqUi8+ 8GJKV2PMSfn9hyDFvEj0qwvBLsgT65tqlEs6mvV4FL378m5E+baSKGGSAXK+3Qzp zGCZMyCUPW39w+sHaK6NBI9HbfSCtZMEeMq0UlhKb6QKvjGcAjzvopLbT8f7BX0G EL0Cs8nV5hQzyV54c4gOvaCmhvW1y/HfGi00YE8Pm61r9skRXcKaO6O3ke6mEsVS zMbsV/9FxYjVRsg+rh9xKQ68ugAW1J6ohPuJbhPKkucRjQr9XpyWALINXywWsXKw S19BQnpYt9q5I4VSQ8LxIqOrr8wMvPOuoo/ml+jwLBZ6xCzK4bp6gqc4ZuXd9XjY lZKjOpOZPycSmdhSXrCYjO+VocOdNQA568G+kiSGhdod4rMxxXKJBWR700vopsbx ScOR6dmowWBFFrcsva19ZY+RevXGunPzvvQGv52LqmApqvDat0yvRFY6uVZtiBr0 9doOE8wnHIsvxUTv+opciPoS52GTgxeE1My6vXgzqJDRRoac1BNIdHtCSvhpK493 gqcGJPdltOZ8AZIPkCmnBX5R5Al38bmU0nYAl7pAbr3JZKR+la4HI0G4HG+QrLIm drzPx8MyxAs5NGblXHhuu+LyRebpOvd6E45/dri1It5kN/FHituJk1hhv0Ym6YOT lZbaz7NfCcs= =Nb9X -----END PGP SIGNATURE----- --=-b1ax81mfbcfld+vwSseD--