From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934709AbcLTK1S (ORCPT ); Tue, 20 Dec 2016 05:27:18 -0500 Received: from mx2.suse.de ([195.135.220.15]:47955 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932467AbcLTK1P (ORCPT ); Tue, 20 Dec 2016 05:27:15 -0500 Date: Tue, 20 Dec 2016 11:27:13 +0100 (CET) From: Jiri Kosina X-X-Sender: jkosina@pobox.suse.cz To: Greg KH cc: NeilBrown , kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org Subject: Re: [RFC 0/4] make call_usermodehelper a bit more "safe" In-Reply-To: <20161220092734.GA12200@kroah.com> Message-ID: References: <20161214185000.GA3930@kroah.com> <87k2b0wus6.fsf@notabene.neil.brown.name> <20161216124913.GB31485@kroah.com> <20161220092734.GA12200@kroah.com> User-Agent: Alpine 2.20 (LSU 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 20 Dec 2016, Greg KH wrote: > > Sorry, I really don't get this. > > > > If kernel memory can be easily changed (which is assumed here), why bother > > with all this? I'll just set current->uid to 0 and be done. > > Because you don't want your current process to uid 0, you want some > other program to run as root. It's quite common for exploits to work > this way, take a look at how the p0wn-to-own "contests" usually break > out of sandboxed systems like browsers. So what kind of sandbox are we talking about here? namespaces-based sanbox? If you have direct access to kernel memory, you can just assign whatever context you want to task_struct's fs struct, and you are out of a sandbox. chroot-based sandbox? Exactly the same argument (you just reset fs->root in task_struct). I stay totally unconvinced that such kind of countermeasure brings any value whatsoever. Could you please bring up a particular usecase, where you have complete control over kernel memory, and still the only possible exploit factor is redirecting usermodhelper? It feels like rather random shot into darkness. Thanks, -- Jiri Kosina SUSE Labs