From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753302AbcHZLgg (ORCPT ); Fri, 26 Aug 2016 07:36:36 -0400 Received: from mail-bn3nam01on0138.outbound.protection.outlook.com ([104.47.33.138]:35601 "EHLO NAM01-BN3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753244AbcHZLgd (ORCPT ); Fri, 26 Aug 2016 07:36:33 -0400 X-Greylist: delayed 3648 seconds by postgrey-1.27 at vger.kernel.org; Fri, 26 Aug 2016 07:36:33 EDT Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Jmax@mail.greenriver.edu; From: Josh Max To: CC: , , , Josh Max Subject: Re: [PATCH] binfmt_misc: allow selecting the interpreter based on xattr keywords Date: Fri, 26 Aug 2016 01:00:35 -0700 Message-ID: <1472198435-17622-1-git-send-email-JMax@mail.greenriver.edu> X-Mailer: git-send-email 2.8.1 In-Reply-To: <1472141735.3489.5.camel@HansenPartnership.com> References: <1472141735.3489.5.camel@HansenPartnership.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [73.97.96.61] X-ClientProxiedBy: BY2PR16CA0009.namprd16.prod.outlook.com (10.164.126.147) To BN3PR03MB2289.namprd03.prod.outlook.com (10.166.74.26) X-MS-Office365-Filtering-Correlation-Id: 7f25ccb1-1444-49b4-c2d9-08d3cd871fc0 X-Microsoft-Exchange-Diagnostics: 1;BN3PR03MB2289;2:JLW+SWJEM1mKLQdwPquRMgxX2+fHS6If8aeGPT7SnzFMiZjeZlVduEZekHVznH6qJ+mxnQTETSutcRR+C0/9u/YFGb9x9BjyX1ImoSeUkA5juKUSxLiDapWqVSnO6XQnR+XFLGpwJ503p7Xec8QSWVDR1Yo+4lAeEF1Lnn2K+BxoH+6bHpY3KyreYkhA7HQo;3:GqIXsI+K/t5pwOfiInlzvUoO0u0cqf+U4ZSrG5X7QUY6GaZ4qCd/JSGkSQTm3a9th/nM3xUxdGevGkNxUxLCtOFTEGn+gIfXURUB2/MD41Jgd0nbN0/coJjDghJKDh68 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR03MB2289; X-Microsoft-Exchange-Diagnostics: 1;BN3PR03MB2289;25:CxFnWKylieLmXOCVhx2oeybHzAyZidOg/AveVl4K0F6xk6fbg6iUmROVHUrFUj1QGlIDK4Ofo7AVI7d5M7whBt+0PnX13J1hdehdJM+u176xQ5KlR/9/rJh/0t2DHG2k7t8X803k9Q2zjW4ibFes2POOmaxqO2mGLELIZx9TBPrty8GOP+vbcJFnMucQ58P3WINUHHM6BZBwMnZG0nPaQHSGm2q0LpoqDmmazTkQs1oL/gMibI7Ycx81IyApJGFHEc+p2Y7Nt+pwv+5QK9QSykv/ifI006JnYCC4dXA9Nyorf9KioI4wR9ixF+pKHAviSlIqy3XUAO2i5PUe/9wZsxaE1TSDjeJWqBnKqRFyc5/K3CqDv5/IpE6KEaJDxAXZPswSo5xMru8Sm+GeWudCV5+2+XW9oj9AVceFUubxc7U8A9ZIZt5cmmkVLLsQ6k1sMIHqJBxA3TBBfbXnaLP9MuGHAXI0IuFNYfgHwxAvMAhdnwNI3CuadKyxg3ngKqfOtDhoyntIKLH0xn0CLM4WVsfsEMj7kvfaeQFCOdubkk5M1nSeSGrsAilg5qrwHGiEM+52GWwZldzBXBB9NA+HOu1kVcckpvWUPxQH/ZhBfC8KLPV11LBAPz76h/TUeHVcCdxNYqM1R7b7Xd2ucBb6hubJAkdKJdUQcdCTXfPBv3MY9GifYL2K6ulWywfw7N0gEOWCFtPEMsXJilhrHlx2nrmKSXhu+cYMpqeX5f+kw09+FzHpIj5Ik92LKZCjfBgH X-Microsoft-Exchange-Diagnostics: 1;BN3PR03MB2289;31:MBK+vBj2G+WJE475HdQy/DTcx2QeilD4QucgpcsjwFZ4LXYnvqtS+PTajJXqoQ+SLRokSqKTAaC6KhBSO1FmjpJt8ND+5izRYW9DxSxNp3jMN4IRrGFK+KG1LQiKYBlw+Or726ucHPDswZuFqSx4OxTiy/L99z1q+VWak9f+zcGXxbfiJuwaFMkL1ojigs8HeyIhcNy2H9e7je4tttifoCRZETghY5xqS5P9gDi0ogE=;20:FVWkoka3brZXR0hd0nkBC0EvxMNdDf9msqGha+577rRzDD1N8+hZaFV9xwl0c2AyiYixEDNZW8yTphTKp9ylsBfu+xPj54E6mu+AZ9VITc6c2/kU0OqHgCdKSlgAYn73ySXF5HrBB+NoMvme7sy9LfXtOjfXEnovElpOTOhx+cNq7HQOdKw0D9c/h11z/CBi7VkOPASReaDZKnwjMzfsxe5ZTia9zVV9dxoeNzWazjD9D5gOBBWzXjajfWCp1OXQjv17Z7O/kALTn7Kzlijnizz0LWrTyAyDkcxuSRvVhBW7raRIWPUBmZZDfuB1y0tmctTiG7JIoFsjWfJkLuoHgLCgl5Tecc975imy9ui9CKM= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(278428928389397)(192374486261705); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040176)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001);SRVR:BN3PR03MB2289;BCL:0;PCL:0;RULEID:;SRVR:BN3PR03MB2289; X-Microsoft-Exchange-Diagnostics: 1;BN3PR03MB2289;4:3fHpiN8zXnnfI+NajVI8rPLJXMZDIaWq9ZQSYBMRC8Son4PVdXN79nSsBerw2EAE2HZtZxAg5qW4e3AP7AeVqbLOoEdXK8bSHte0URYombmWb4HnOOXOMdmp4PMmIe4o9JacGphO+p47IhtoZEwtCuEVI9yJl1OyF6gigMy0IdnZtKGdlnfN6Q5FaKDgrWkQp5ZdLuWWq4uLLg3sSVfPQZSSYxzGMNd/9GJrxGpSNNEWx2XyuxqUbO0RTjaUk6P6hIbhd2jq1dCuS4+H6nWP6QzowSw0xDtTj7biOj0awBcBw/gW7yYeRhoZNUCC1wz542n3LjGO2akgvyasUzX6D/TDpFSszaQBWj/eez4CwA08oCJwes5q7Zm0eYfGXXZ37TMZsaJ/QpKr9XNg2NuceGdggShbOGCage1uk/TiXRScvwsVHvr2GpFz1tB78odwGcnIvFtD/dXV08qk9dtphw== X-Forefront-PRVS: 00462943DE X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(7916002)(189002)(199003)(24454002)(92566002)(189998001)(2950100001)(2906002)(68736007)(88552002)(4326007)(97736004)(48376002)(586003)(101416001)(50226002)(50466002)(50986999)(76176999)(81166006)(5003940100001)(305945005)(77096005)(80792005)(69596002)(8676002)(7736002)(81156014)(7846002)(5660300001)(47776003)(2351001)(107886002)(110136002)(89122001)(75432002)(66066001)(53416004)(42186005)(4001430100002)(3846002)(86362001)(106356001)(105586002)(6116002);DIR:OUT;SFP:1102;SCL:1;SRVR:BN3PR03MB2289;H:nullbox.sinuous.gov;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;BN3PR03MB2289;23:1UDezm3uWaLgnqTucgJSM4pse7CzkruIMUHx2cVQR?= =?us-ascii?Q?tnxAslLwpw13pBsCoQXEMP2K4J6vWbwavTdNcDykfpVgKn756E64mVKnShW0?= =?us-ascii?Q?PDS8A79sarAOMgDWKxdiOZgE9s7QwYAP3raTrjhgKf4wVqcjdCbh37B1fecD?= =?us-ascii?Q?RKLHQH8BMMkoGB5bTckM9PigWaRoRBDZHBFtr4F0iFbWzwFMcTnnIHN+VM5w?= =?us-ascii?Q?pfhzBFwkxr1sJzFyKyaP+mFIN8OvJQ0sIybRoqs1VP0nuK6FWPvXFUSjvWG3?= =?us-ascii?Q?wQQTyoVD2OjICwg7uR6LglFjPF1dN/p6VGPjWtzO3/7queVik6xubpNFXgX7?= =?us-ascii?Q?3Bie6nFGvybw9WzI0gBbi03nDZa/NREdV2X+pPiR96L/ewVkm1+EH/fqD4DR?= =?us-ascii?Q?oYJq5Huhaee9tJcvosFkuNOIh74gSciHct0eDW/DRxMxUJ64iNGA0NiShUpd?= =?us-ascii?Q?bUcdnoHSfZCWQncJueXSOyLsXdoFCOY8tX2SsQIlspS/sNJ9mnrCar6eNwIk?= =?us-ascii?Q?KDlaH7X8Xet/6xyEfE13Wua1K6cqNX1W8BRBXSksQGYYxhh2STOSBDviADhg?= =?us-ascii?Q?1f2NIA/Jxy8fwf+T6AIMTtc3PogwrzSFjJL+2q5D/rC5rBbcmgUJRS81S1yK?= =?us-ascii?Q?nUrjpkqRIHmMzCYHinCoUXMaro/1o5bYtTgYNudyQB7g6iX+MxccHz4j1qf+?= =?us-ascii?Q?91zuJqcOTfnqpARbLfTJSjBVDIf1fcYjy31wM8mNtoQJdoq/jLFYEl4lFNwu?= =?us-ascii?Q?zvDpRfKBP+luuZ3qqMzCN2QRewNqspYfIC20Sh8EU3lQLGhrrskZo4cZkClJ?= =?us-ascii?Q?brVtpHWXB/+vpsHghEBfDbDbxN+fu6appQ/xyB0Ue44fb3vY6i7rFaX7IwvY?= =?us-ascii?Q?n416yRj/zpAEsVFsCcmF7YC8qhtG5HXQS1A6ER31BNmBRBj1H+fPmc6zw4wG?= =?us-ascii?Q?rUti7NV73fTkqDX5Byw1IfxfoSF/bXPF8zd+XN2fULdnZdkV3tOiNxtWtCeQ?= =?us-ascii?Q?TCmLme3KJh4zQxcdQ75LSz1P+IKZhnwO+d9Ew12zJ+yfRt6+zkB01QJRxEOS?= =?us-ascii?Q?IRV4jv4/Xt5J2G4/11xOZzZrauVCUlypSYCerO4zkvmcs1GE7qN39a7auKNz?= =?us-ascii?Q?7qyfcAezuBf+pbhMGYH21NKD8ahncu8?= X-Microsoft-Exchange-Diagnostics: 1;BN3PR03MB2289;6:RB1mbpbeV6aA7oA2xwJlbD7qAQifGVrRUIN4/6uJFsrBs3xBZkbZo8A/lOgvPoxQDQcCJ+PQUXBfw4ZSnt5tCMqiv1IqOJ6lfUJGPd605kvmJrbEya1mnofpLKBEpY0edqGVfHhjqbaCsgKqXoLqkODSW5ronSQaDdeUDDgIYS8XIzpEv9aT4y+tvpmHXk+tnAokpqm7zcib8n98288Ut8LvTIH/IwA/rkAOS7Lqrk5MM74zIS6K+9V41VlpFMf0i6aYGJ1NHwEGYUXtxcU58NF0ytHn9Ye3PqwtFI3eNQY=;5:zuOAxM6dM2vvLyeJlMunnsHcGD58s7cuiYGSZxMtndWLIXIGMlLPx4aujzt+/jjquDbJMkzNWmFJeiwckqxKS3zGl2MQk81exuBki6dsP7RGFSw/Sjh2Sx/xkAXJfgkzCGnHacqalAvOkq8VBrmqPQ==;24:tFx9GOKi5vQwBGWVXcqZz0DxrJ+OjJWrUB3ZSLJ4sxpXfyPR9JXUjRHHLEDqFv9GPjj1bh6EmlelYi1XnDLAwq/+gJbOnujf2DwFDECQBJo=;7:ghLf9Ra/mV68WzJfOiJSHNY9Dk29sAZFPPwbSTtetDAzVLS8ZCTzra5iifEDIXTEVTGt/cTIEQzaMA1MsfdC3ObaPNvhdtZRDVR/Sn71q4h0kkLbhP0/oVaMcGvGiYfYtIU28Sjupg5jSdQsRR4zYAfHXhWu/dM6cN24f+kOHZmhgjL4XiR11B20MfapvrGDbQS0d1RV3Kw/yeX3c+MMrLPFa0OdrhTbJodBYgqPIyx8OkT2CT8KUa/CGHyUNcKp SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: mail.greenriver.edu X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Aug 2016 08:01:01.9711 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR03MB2289 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 25 Aug 2016 16:15:40 +0000, James Bottomley wrote: > Could you expand on the use cases? The patch set looks OK; the issue > with extended attributes is lack of universal support on filesystems, > but that may not be a problem because they're definitely supported on > all the standard ones. I think the current F flag solves the foreign > binary in chroot or container. Self sandboxing sounds reasonable, but > if this is a security feature, doesn't having the label under the user. > EAs mean that the confined binary can simply remove the label and > unconfine itself? Regarding sandboxing, my intent on this patch was to sandbox "trustworthy" binaries (e.g. Apache, ssh, _insert_web_browser_here_, etc.) to reduce their attack surface, rather than reduce the chances of a malicious process compromising the system (without the need of maintaining a bunch of wrapper scripts to launch said binaries under a sandbox). As such I'm using this patch to sandbox Android's "app_process" service, as well as my personal web browser. Of couse, it also has other benefits as well. For instance, an observatory control software I use has a master daemon and several dome control drivers, which are also native executables. Normally, you would need to provide the correct driver as a parameter to the daemon, but with this patch simply loading the driver also loads the daemon. I know of a few other applications that do something similar to this that could benefit from xattr-based interpreter selection. Josh