From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751491AbdARXdp (ORCPT ); Wed, 18 Jan 2017 18:33:45 -0500 Received: from mx2.suse.de ([195.135.220.15]:58003 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751134AbdARXdm (ORCPT ); Wed, 18 Jan 2017 18:33:42 -0500 Subject: Re: [PATCH] procfs: change the owner of non-dumpable and writeable files To: Kees Cook References: <20170118040159.4751-1-asarai@suse.de> Cc: Andrew Morton , Michal Hocko , Oleg Nesterov , Al Viro , John Stultz , Mateusz Guzik , Janis Danisevskis , LKML , dev@opencontainers.org, Linux Containers From: Aleksa Sarai Message-ID: <45b680a7-cdc7-8c53-1cf9-92a5afc5f55f@suse.de> Date: Thu, 19 Jan 2017 10:34:02 +1100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org >> In order to protect against ptrace(2) and similar attacks on container >> runtimes when they join namespaces, many runtimes set mm->dumpable to >> SUID_DUMP_DISABLE. However, doing this means that attempting to set up >> an unprivileged user namespace will fail because an unprivileged process >> can no longer access /proc/self/{setgroups,{uid,gid}_map} for the >> container process (which is the same uid as the runtime process). >> >> Fix this by changing pid_getattr to *also* change the owner of regular >> files that have a mode of 0644 (when the process is not dumpable). This >> ensures that the important /proc/[pid]/... files mentioned above are >> properly accessible by a container runtime in a rootless container >> context. >> >> The most blantant issue is that a non-dumpable process in a rootless >> container context is unable to open /proc/self/setgroups, because it >> doesn't own the file. > > This changes a lot more than just setgroups, doesn't it? This bypasses > the task_dumpable check for all kinds of things. Yeah. I can special case /proc/self/setgroups as well as uid_map, gid_map and the other *specific* things that runC needs. But ultimately I think we should come up with agreement on what things should always appear to be owned by the process's user. > Though, I expect the > has_pid_permissions() check to be the harder one to pass. Why does > has_pid_permissions() succeed in the case you've given? Because the group id of the container process is the same as the parent process, so is_group_p() will succeed. Also hide_pid_min is set such that it will work in either case. -- Aleksa Sarai Software Engineer (Containers) SUSE Linux GmbH https://www.cyphar.com/