From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753247AbcGMKrk (ORCPT ); Wed, 13 Jul 2016 06:47:40 -0400 Received: from mail-db5eur01on0115.outbound.protection.outlook.com ([104.47.2.115]:20256 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751380AbcGMKra (ORCPT ); Wed, 13 Jul 2016 06:47:30 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=skinsbursky@virtuozzo.com; Reply-To: Subject: Re: [PATCH] prctl: remove one-shot limitation for changing exe link References: <20160712152940.24895.61315.stgit@localhost.localdomain> <20160712164800.GD3661@uranus.lan> <87inwa2406.fsf@x220.int.ebiederm.org> To: "Eric W. Biederman" , Cyrill Gorcunov CC: , , , , , , , , , , , , , From: Stanislav Kinsburskiy Message-ID: <360f9182-0685-7625-14db-daf821043db0@virtuozzo.com> Date: Wed, 13 Jul 2016 12:47:10 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Icedove/45.1.0 MIME-Version: 1.0 In-Reply-To: <87inwa2406.fsf@x220.int.ebiederm.org> Content-Type: text/plain; charset="windows-1251"; format=flowed Content-Transfer-Encoding: 8bit X-Originating-IP: [178.19.210.162] X-ClientProxiedBy: AM5PR0901CA0020.eurprd09.prod.outlook.com (10.164.186.158) To HE1PR0801MB1274.eurprd08.prod.outlook.com (10.167.247.140) X-MS-Office365-Filtering-Correlation-Id: ce949f71-2a19-4187-0a26-08d3ab0b0dfb X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1274;2:U7dAFSy7Rc47OxGcayZ7MYmYJqsIHlaRS0+bpn3LFk66Sbl/ogM5Jx/rktx92PvvVMEf1IjiPf+0m7R9BozMEjSYVRWv92PzVkSC6tLzNUYRr2Pdlpe0JW1ZVqJ50Am45dwDnFyLC4dvGCUkGINymco44UWdplSfqrcuZIoNMpI3sf4BeRAF9zCqAg1DK1aU;3:sQHoGCQ7W2FJUHpZHPhXBrMGJkKa7V1BW7QB9P/3L5m8JJObAMY/RQhf4HtM397CSXsk558I8ZDXaAye6LoKQY0Ea2vxYnd+5rRWoFN9U1XbYGg5DKz5GJJxfHDdIIzT;25:eROiwdw8EtovdLKPTM9w7EVKsaJyrswAsAk15r977A39yO+54x1WEGSB0b73L15wqR4pdOZlBcFqYH+iDf5tgGoEAfsigUbFyAiKmOW7gQqfYwGSLCF+U+5JAB8AfLR/7TDqibqyWf+5QCBlPFEKjxjo8uzLgcOtCJ7a9XPzhdLRhxFgGUSQglY69ZuD9IdyKMMgc2qB7errY3VmK7yROvzkTrjCFWOvKKTCxKSf1kfLRoYothod/x39DpnUdXilfmXanQmPFMeY/y9vQ9Ocj9nyirRkujW1QuzZWJYPDRIcJJInM+OM21uXJ8LYUV/MDVZOU79aKq+SptlDgSzk3wg9APmJVZG07ag4Y7Wb+XTXPmwMpmHmDPdYdyyPxfkm9RR0Xc6nZSTuZcTTX0NCPAxyQeJBuZCQmcsSNizKCbU= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:HE1PR0801MB1274; X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1274;31:C6csrTzkRkRIy+2Mtd3Y6S/MaK9ekVBKBjSMTyyEziNm68wk2plYoC+IR7SVCE90kR96dtsB3K7w9KKGRfZ6UTchs+l/4BYqmuBEEM6Pu51uXM+qwEoeOmSYO2DdeA4uES0wqS8GkFAZjnQtmR++bHg2zFbvDdnphuivzYBL39vNmhAjX3oFoRNYrHsIfUHEC4GHXqrkzM+ttPgsv+bvuQ==;4:07EpnTRm9zGcuNA98RZH7L6+VP0lfrojdYGODN3+kaJCzBCiIETEb5GeER4e/M8dxcXyOSTKFbjtdx1sJGCqK1PU7q26h2HIfEcBHwaNDRXGJeHW0zABqeDFTt0e6L0qWzkOF3UyElRqUkC+K/cRSOWQXlWxIACJHxyWan1z8ICFInrWlDyBk7DS7jeyY61OGxo62C2GwsUIayI9Fx5EEGfhgs8roLFZkFIVodYkLN5fzPiBaTPUwVe/79/BkkPjmOTbefXMIEJP2zLubRpqXnw7xyhLUFwZw3KXheIQtpC+qEFnPO4ID6VdL4oZbPMZZhR0kkfglOllkmIAantCihd9d6JtNcesek5PDwTQGFofTWxWmfgVdKyOfed78XXv0csdpotcCGDJuNutMg7ug15Odd6vYKEPLr5RVrD+96Ne3eKkz/1NfE3QGw8BIAX4CBHkHhhqeUnC/DVb4X5rjkJc+MsDOOiS2p6zCeuJE/Il67mwVS5yg4RTlIMb1ZD1 X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(788757137089); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040130)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6041072)(6043046);SRVR:HE1PR0801MB1274;BCL:0;PCL:0;RULEID:;SRVR:HE1PR0801MB1274; X-Forefront-PRVS: 000227DA0C X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(6049001)(7916002)(209900001)(189002)(24454002)(199003)(77096005)(15975445007)(106356001)(2950100001)(83506001)(8676002)(81156014)(81166006)(105586002)(2906002)(86362001)(42186005)(6116002)(43066003)(101416001)(15395725005)(31696002)(33646002)(3450700001)(586003)(4326007)(50466002)(8666005)(3846002)(36756003)(47776003)(19580395003)(19580405001)(7846002)(31686004)(50986999)(53806999)(64126003)(66066001)(76176999)(54356999)(7736002)(107886002)(4001430100002)(189998001)(68736007)(5890100001)(2870700001)(5001770100001)(97736004)(4001350100001)(23686003)(305945005)(7059030)(6606295002);DIR:OUT;SFP:1102;SCL:1;SRVR:HE1PR0801MB1274;H:[10.1.197.90];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?windows-1251?Q?1;HE1PR0801MB1274;23:iDIsgqPTYBDRjhdxKBVzLsVvYA8ztXZDxbb?= =?windows-1251?Q?ca61CBEt91q2lTio5Dwe6YgbfHhEohlMzgUVjzCr2jk/3A1A54eZ/bOc?= =?windows-1251?Q?oH9wQRUrFeenhVPdJuICNNLTfrn0D5xqcw7icbwDsx4lJYchtgE8nsL9?= =?windows-1251?Q?F4I67aUZZ4HdgtYzHH+ZxaZ+Qg6sE+RWDK5tCnw0961tXvPRat1YyOSK?= =?windows-1251?Q?FmWvzJsVE4dcwRLPK4b/+ZQvOzRAewIZoboqgEvFrmY7Tyrnw2qVrCV3?= =?windows-1251?Q?tJ37e+tZo8G1a5/SJykexTnDbtRzw+zvT276bx4evoxIc0v9lWRBYFwr?= =?windows-1251?Q?jiqT2rvTPu1I8CkMPJl2SQAqTjm57VCilvzPOaOb/NNMHEEB8D23ymOJ?= =?windows-1251?Q?H+PxoI/FyXVZWpvE+IXDrsveUFZl/evhUT4Sw2OzqZwCfxAow3crxGqv?= =?windows-1251?Q?JvTZc6knSEMdOGdKxJoz0Fc27NhunH240xfv3QgMK3thtwRlHasPYmXw?= =?windows-1251?Q?dGqpHtrouqb3EOcchq/hA5ldrBcPqLK4BtmgKTY35n248BpVqy9ShIuK?= =?windows-1251?Q?L7e3yXoNPOGghIPysqz3UH+BviirslumItU2hdCdvGJeD+hr+4uk7mJN?= =?windows-1251?Q?aIyu8tECUkkL7x+bjEl2RW4vCzm3dZoEljX68yGTJUwHmANWOgvQm+Rz?= =?windows-1251?Q?9rV6NmOY0+ZwFHC3G8UB2KnnqP1KRYgYW9VxqtoU19+qnsSb6x7zrQap?= =?windows-1251?Q?9kupD4eFYP6UFfP1VI07uFog4G55BIQA+/VqoTZ8o343E2YL7zOwf7V9?= =?windows-1251?Q?DJXHD33L3HotQiDLr7duRcXSWCH0ZtwR6epCJotQPEkfaLBZi9Ms52MR?= =?windows-1251?Q?I/uXEB1/5PWSBYrnYLi0XZNAF2XqjQ6CjqWZOMVyIfNgkI9WHZ6j9NJd?= =?windows-1251?Q?lCeq/ipIm2qe7oPI7gSVycEpDc8NXkKP8zr3LLUkqq0K5YZhaagqxSFB?= =?windows-1251?Q?G0/jq4nqBU56fBKwdAmKcclcFjyY0ytmG6/emP62Cbd48wJuWHlXHKCv?= =?windows-1251?Q?g+Fnluvmrlm+Sj+7aEWYtjlQlHZAYpqAd0z1IN/rKvEG5rnjUdYsGdF/?= =?windows-1251?Q?40+c78Nft15taQDqzVFZOSWqJdXciokDvPQMefnTpRiUTTtk9arGGqDn?= =?windows-1251?Q?nGMnDvcJeP9I5/uh73yQZqSu+x7Bp2Tg/orRWNsMynCwEuPg1Ef6J7dH?= =?windows-1251?Q?hAeiOHW60E01LxtUpKUfllCWhY6cXL8ngvp84QXk/v0a9WNRzXmTki5r?= =?windows-1251?Q?uALAbp4Lod/b+6Y1u/CyzGb0z7qUrtATaeSdI3ubHFSFlsU9Mpms3sn7?= =?windows-1251?Q?Y1zpQru5Au9B76VYcd5SrKIJqbrNnx0OxVsY6erpSDoe4FVQPq0x1Jaj?= =?windows-1251?Q?MyzFGYZ8086UTXgN39fykmxu4r0znyLw/1CSDPKGC65hszgLoa5WXeoy?= =?windows-1251?Q?rt8V9uLu/S6sdcrg3TfX4a9A2nbRWnp9993aahm0bTsP3fc4maebT8kP?= =?windows-1251?Q?cyHe8wmtqdc4M0d9sfdaudk5d0cVR73S5G9kS?= X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1274;6:zG4e6bEcsKxISPN5oS9vW3PREMPKMZf4wtW4h8N3Qj+FBaGjsnnhePHFTRpsF+g8eXGe+lB0eaAmxJyxBImr9i0Otu8E2Sy12TRH19Iz2PJE5rJdZeSq6Bh9n9gu0Adl40Aq26nY3CB9dRQkLUmFvE1t6ZN/K9txTe+Yck0F2xVGVAmx6vTsmFJQdzgFb2qju9mLMyIJKvp/M0fH1lZnrV42Q05imtlFM0/sZerWJiQlTzPn8H2xcSFhsioZG+aF8VgrPBMptaRK+aKTiAPpNJZbAS0XWMFadDDiR8vzdjVbznfznBWAotO+INanbVb2;5:lwRTHaypOT3MIQX6IQbFZCXopjrcKE5L3uYdzlqPrzx7Dc0mAD5myIGQ4JdjNrra5/BatKTvHWeL+uYU9+/HDJ/MYdnZ1tB0LB8cg3tfHqvN4f5DNF9EzUN9dKDdQAyiaDk8PyoSUQtNniJU9fH9KA==;24:+azS+yIx0wqUcENUxXxU/8n8NuoPn73kyyYzR5QGYHQBLCQFiHl/ZtOm1Heu835wMpCyi0pHq6/dfXFLGQHGOo7A3I4nJEYqZph2og8tfVw=;7:hZUW/llakUYwfwmlRl4fzbE3X/6TKJPof5F89clLBUuR74Rf9YC/bWz5QmnO33Rf9TJRZZ5vu/8ydOE93EzRjpfCcpxUbiTU6iTUH+Y/k3yUa16USo5XR9JFbgert/moiCKux0fSWLo2w9VKy/kyKFtBZ6+MtLo9Cj/tOgvAW7iOIPAeaST+n6VadCY6psWdm3LHQnVQN9Epm74YVxY821vKEJij9IAu/vGfv2lk2gkyDTr2WPNbkEs6ins3ahBg SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1274;20:GXfOUTsDPtDQhbvVETuvZhp/rWA2K2YjvcT41QiTKXdD+RmS6MDJ+WV1vE95Sh3+NhI81F/aJ7gKmP8ULUrgpjayDPQQWNgA+tQusq4Wm/bya9oohpZx7XD0NBDuubhMTbuQUGxehQ/ZF8LtpjTzubwErYzrC3V+iWE/4AEAc20= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2016 10:47:14.6519 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0801MB1274 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 12.07.2016 18:52, Eric W. Biederman пишет: > Cyrill Gorcunov writes: > >> On Tue, Jul 12, 2016 at 07:30:29PM +0400, Stanislav Kinsburskiy wrote: >>> This limitation came with the reason to remove "another >>> way for malicious code to obscure a compromised program and >>> masquerade as a benign process" by allowing "security-concious program can use >>> this prctl once during its early initialization to ensure the prctl cannot >>> later be abused for this purpose": >>> >>> http://marc.info/?l=linux-kernel&m=133160684517468&w=2 >>> >>> But the way how the feature can be used is the following: >>> >>> 1) Attach to process via ptrace (protected by CAP_SYS_PTRACE) >>> 2) Unmap all the process file mappings, related to "exe" file. >>> 3) Change exe link (protected by CAP_SYS_RESOURCE). >>> >>> IOW, some other process already has an access to process internals (and thus >>> it's already compromised), and can inject fork and use the child of the >>> compromised program to masquerade. >>> Which means this limitation doesn't solve the problem it was aimed to. >>> >>> While removing this limitation allow to replace files from underneath of a >>> running process as many times as required. One of the use cases is network >>> file systems migration (NFS, to be precise) by CRIU. >>> >>> NFS mount can't be mounted on restore stage because network is locked. >>> To overcome this limitation, another file system (FUSE-based) is used. Then >>> opened files replaced by the proper ones NFS is remounted. >>> Thus exe link replace has to be done twice: first on restore stage and second >>> - when actual NFS was remounted. >>> >>> Signed-off-by: Stanislav Kinsburskiy >> Persistent exe-link doesn't guarantee anything if you have rights to ptrace >> task and inject own code into (from security POV). So lets rip it out. >> >> Acked-by: Cyrill Gorcunov > I believe the original concern was someone injecting a code into a > process and playing silly buggers with the exe link. Someone who does > not have ptrace capability. > > It is completely not ok to change this until someone goes back to the > original conversation and looks at the original threat model, and > refutes it. Fair enough, Eric. That's why all the people, who were participating in original discussion, included in the recipients list. > Eric >