From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752573AbdASNHb (ORCPT ); Thu, 19 Jan 2017 08:07:31 -0500 Received: from mx2.suse.de ([195.135.220.15]:55922 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750947AbdASNHa (ORCPT ); Thu, 19 Jan 2017 08:07:30 -0500 Subject: Re: [PATCH] procfs: change the owner of non-dumpable and writeable files To: Michal Hocko References: <20170118040159.4751-1-asarai@suse.de> <20170119092930.GJ30786@dhcp22.suse.cz> Cc: Andrew Morton , Oleg Nesterov , Kees Cook , Al Viro , John Stultz , Mateusz Guzik , Janis Danisevskis , linux-kernel@vger.kernel.org, dev@opencontainers.org, containers@lists.linux-foundation.org, "Eric W. Biederman" From: Aleksa Sarai Message-ID: Date: Fri, 20 Jan 2017 00:08:12 +1100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: <20170119092930.GJ30786@dhcp22.suse.cz> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org >> In order to protect against ptrace(2) and similar attacks on container >> runtimes when they join namespaces, many runtimes set mm->dumpable to >> SUID_DUMP_DISABLE. However, doing this means that attempting to set up >> an unprivileged user namespace will fail because an unprivileged process >> can no longer access /proc/self/{setgroups,{uid,gid}_map} for the >> container process (which is the same uid as the runtime process). >> >> Fix this by changing pid_getattr to *also* change the owner of regular >> files that have a mode of 0644 (when the process is not dumpable). This >> ensures that the important /proc/[pid]/... files mentioned above are >> properly accessible by a container runtime in a rootless container >> context. >> >> The most blantant issue is that a non-dumpable process in a rootless >> container context is unable to open /proc/self/setgroups, because it >> doesn't own the file. >> >> int main(void) >> { >> prctl(PR_SET_DUMPABLE, 0, 0, 0, 0); >> unshare(CLONE_NEWUSER); >> >> /* This will fail. */ >> int fd = open("/proc/self/setgroups", O_WRONLY); >> if (fd < 0) >> abort(); >> >> return 0; >> } > > I do agree that failing to open anything in /proc/self/ is more than > unexepcted! I cannot judge the patch but my gut feeling tells me that > the fix should be somewhere in the open handler. Maybe that would suffice as a more specific fix (for the special case of /proc/self), but the fact that none of the users and groups are correctly set in /proc/[pid] will cause issues for runC and other container runtimes (because they don't go through /proc/self -- it's accessing /proc/[pid] from another process). Though I get the feeling that the *correct* fix would be to remove the conditional and *always* change the owner -- maybe I'm missing something but I can't think of the security issue that this code currently fixes (since all of the important permission checks are *in addition* to the generic_permission used for /proc/self/..., which use ptrace_may_access). -- Aleksa Sarai Software Engineer (Containers) SUSE Linux GmbH https://www.cyphar.com/