From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932631Ab2AMS0y (ORCPT ); Fri, 13 Jan 2012 13:26:54 -0500 Received: from lxorguk.ukuu.org.uk ([81.2.110.251]:43375 "EHLO lxorguk.ukuu.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753499Ab2AMS0w (ORCPT ); Fri, 13 Jan 2012 13:26:52 -0500 Date: Fri, 13 Jan 2012 18:24:22 +0000 From: Alan Cox To: Oleg Nesterov Cc: Andy Lutomirski , Will Drewry , torvalds@linux-foundation.org, linux-kernel@vger.kernel.org, keescook@chromium.org, john.johansen@canonical.com, serge.hallyn@canonical.com, coreyb@linux.vnet.ibm.com, pmoore@redhat.com, eparis@redhat.com, djm@mindrot.org, segoon@openwall.com, rostedt@goodmis.org, jmorris@namei.org, scarybeasts@gmail.com, avi@redhat.com, penberg@cs.helsinki.fi, viro@zeniv.linux.org.uk, luto@MIT.EDU, mingo@elte.hu, akpm@linux-foundation.org, khilman@ti.com, borislav.petkov@amd.com, amwang@redhat.com, ak@linux.intel.com, eric.dumazet@gmail.com, gregkh@suse.de, dhowells@redhat.com, daniel.lezcano@free.fr, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, olofj@chromium.org, mhalcrow@google.com, dlaor@redhat.com, corbet@lwn.net Subject: Re: [PATCH] Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs Message-ID: <20120113182422.28e648fb@pyramind.ukuu.org.uk> In-Reply-To: <20120113164547.GA22061@redhat.com> References: <20120113164547.GA22061@redhat.com> X-Mailer: Claws Mail 3.7.10 (GTK+ 2.24.8; x86_64-redhat-linux-gnu) Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAFVBMVEWysKsSBQMIAwIZCwj///8wIhxoRDXH9QHCAAABeUlEQVQ4jaXTvW7DIBAAYCQTzz2hdq+rdg494ZmBeE5KYHZjm/d/hJ6NfzBJpp5kRb5PHJwvMPMk2L9As5Y9AmYRBL+HAyJKeOU5aHRhsAAvORQ+UEgAvgddj/lwAXndw2laEDqA4x6KEBhjYRCg9tBFCOuJFxg2OKegbWjbsRTk8PPhKPD7HcRxB7cqhgBRp9Dcqs+B8v4CQvFdqeot3Kov6hBUn0AJitrzY+sgUuiA8i0r7+B3AfqKcN6t8M6HtqQ+AOoELCikgQSbgabKaJW3kn5lBs47JSGDhhLKDUh1UMipwwinMYPTBuIBjEclSaGZUk9hDlTb5sUTYN2SFFQuPe4Gox1X0FZOufjgBiV1Vls7b+GvK3SU4wfmcGo9rPPQzgIabfj4TYQo15k3bTHX9RIw/kniir5YbtJF4jkFG+dsDK1IgE413zAthU/vR2HVMmFUPIHTvF6jWCpFaGw/A3qWgnbxpSm9MSmY5b3pM1gvNc/gQfwBsGwF0VCtxZgAAAAASUVORK5CYII= Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This still appears to be a bit broken There are three problems here 1. I can stop an app changing privs which in some SELinux or APParmour cases might mean I prevent it being dropped into a less privileged position. That's something only the security policy knows. So for SELinux and Apparmour and the like in some situations you are potentially adding a security hole. That one seems hard to fix unless you fail the exec if it causes a security transition, as opposed to just keeping the old one. For non change cases we can however still pass the filter on, which is the usual sane case. 2. ptrace You neeed to also stop ptrace otherwise the locked down process can use ptrace to proxy its activity via another task with the same uid. That's easy enough to add fortunately. 3. file access You have the same attacks via patching files of running apps etc. In the intended circumstances I'm not sure this matters or is cleanly fixable. It's the point at which you need a real system wide policy and SELinux etc anyway. Alan