From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4BD1BC7EE2A for ; Fri, 2 Jun 2023 01:41:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233759AbjFBBl5 convert rfc822-to-8bit (ORCPT ); Thu, 1 Jun 2023 21:41:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34752 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233609AbjFBBlz (ORCPT ); Thu, 1 Jun 2023 21:41:55 -0400 Received: from out01.mta.xmission.com (out01.mta.xmission.com [166.70.13.231]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EEA1E97 for ; Thu, 1 Jun 2023 18:41:52 -0700 (PDT) Received: from in02.mta.xmission.com ([166.70.13.52]:52334) by out01.mta.xmission.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1q4tna-004fqV-3x; Thu, 01 Jun 2023 19:41:50 -0600 Received: from ip68-110-29-46.om.om.cox.net ([68.110.29.46]:56980 helo=email.froward.int.ebiederm.org.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1q4tnY-0034gx-SS; Thu, 01 Jun 2023 19:41:49 -0600 From: "Eric W. Biederman" To: Paul Moore Cc: "~akihirosuda" , linux-kernel@vger.kernel.org, containers@lists.linux.dev, serge@hallyn.com, brauner@kernel.org, akihiro.suda.cz@hco.ntt.co.jp References: <168547265011.24337.4306067683997517082-0@git.sr.ht> <87fs7abu0f.fsf@email.froward.int.ebiederm.org> Date: Thu, 01 Jun 2023 20:41:42 -0500 In-Reply-To: (Paul Moore's message of "Thu, 1 Jun 2023 21:01:55 -0400") Message-ID: <87ilc67i95.fsf@email.froward.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8BIT X-XM-SPF: eid=1q4tnY-0034gx-SS;;;mid=<87ilc67i95.fsf@email.froward.int.ebiederm.org>;;;hst=in02.mta.xmission.com;;;ip=68.110.29.46;;;frm=ebiederm@xmission.com;;;spf=pass X-XM-AID: U2FsdGVkX19VrZxVOemsucyaabfl73Cwk/oBg1+agj4= X-SA-Exim-Connect-IP: 68.110.29.46 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: [PATCH linux 0/3] [PATCH] userns: add sysctl "kernel.userns_group_range" X-SA-Exim-Version: 4.2.1 (built Sat, 08 Feb 2020 21:53:50 +0000) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Paul Moore writes: > On Thu, Jun 1, 2023 at 8:14 PM Eric W. Biederman wrote: >> Paul Moore writes: >> > >> > Given the challenges around adding access controls to userns >> > operations, have you considered using the LSM support that was added >> > upstream last year? The relevant LSM hook can be found in commit >> > 7cd4c5c2101c ("security, lsm: Introduce security_create_user_ns()"), >> >> Paul how have you handled the real world regression I reported against >> chromium? > > I don't track chromium development. You have chosen to be the maintainer and I reported it to you. >> Paul are you aware that the LSM hook can not be used to achieve the >> objective of this patchset? > > /me shrugs > [snip parts about performing a group id check] The LSM hook you added does not have the technical capability to reduce the attack surface to mitigate bugs in the kernel. It is the ineffectiveness of the hook not the permission check that I was referring to. Eric