Messages in this thread | | | Date | Sun, 27 Dec 2009 10:47:47 -0500 | From | Michael Stone <> | Subject | Re: RFC: disablenetwork facility. (v4) |
| |
Serge Hallyn writes:
> Michael Stone, without looking back over the patches, do you also > restrict opening netlink sockets?
The current version of the patch restricts netlink sockets which were not bound to an address before calling disablenetwork(). It does so primarily on the grounds of "fail safe", due to the following sorts of discussions and observations:
http://kerneltrap.org/mailarchive/linux-kernel/2007/12/7/493793/thread http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5461 http://marc.info/?l=linux-kernel&m=125448727130301&w=2
I would be willing to entertain an argument that some kind of exemption for AF_NETLINK ought to be introduced but I'd need to hear some more details before I could implement it and before I could satisfy myself that the result was sound.
> Should we worry about preventing an error message from being sent to the > audit daemon?
I've considered the matter and I don't see much to worry about at this time.
The first reason why I'm not too worried is that anyone in a position to use disablenetwork for nefarious purposes is also probably able to use ptrace(), kill(), and/or LD_PRELOAD to similar ends.
The second reason why I'm not too worried is that I believe it to be straightforward to use the pre-existing MAC frameworks to prevent individually important processes from dropping networking privileges.
Do you have a specific concern in mind not addressed by either of these observations?
Regards,
Michael
| |