Messages in this thread | | | Date | Wed, 15 Apr 2009 17:05:03 -0400 | From | Oren Laadan <> | Subject | Re: CAP_SYS_ADMIN on restart(2) |
| |
Serge E. Hallyn wrote: > Quoting Dave Hansen (dave@linux.vnet.ibm.com): >> On Wed, 2009-04-15 at 23:21 +0400, Alexey Dobriyan wrote: >>> Is sysctl to control CAP_SYS_ADMIN on restart(2) OK? >> If the point is not to let users even *try* restarting things if it >> *might* not work, then I guess this might be reasonable. >> >> If the goal is to increase security by always requiring CAP_SYS_ADMIN >> for "dangerous" operations, I fear it will be harmful. We may have >> people adding features that are not considering the security impact of >> what they're doing just because the cases they care about all require >> privilege. > > Nah, I disagree. (Or put another way, that wouldn't be the goal) > There are two administrators we want to satisfy: > > 1. the one who wants his users to do partial checkpoints, but doesn't > want to risk giving away any privilege at all in the process. He'll > be satisified by setting restart(2) to not require cap_sys_admin, > and his users just won't be able to do a whole container. A lot of > users will be happy with that (though no SYSVIPC support, then).
There is also a middle way: use setuid program to allow creation of a new namespace (under your favorite policy), then drop the privileges and continue as unprivileged inside that container.
IOW, don't make the initial container-creation a barrier for the entire operation.
Oren.
> > 2. the one who may have one or two users who he trusts to do > checkpoint/restart, but otherwise doesn't want even the slightest > risk of other users using restart, and maybe finding an exploit. > That one is probably the more common admin, and he'll be satisified > with requiring CAP_SYS_ADMIN for all restart(2)'s, since he's ok > risking giving extra privilege to the ones he trusts. > > And meanwhile, by virtue of leaving (1) supported, we are still > more under the gun to make sure that everything restart(2) does > is properly checked. > >> What would the goal be? >> >> -- Dave > > -serge > _______________________________________________ > Containers mailing list > Containers@lists.linux-foundation.org > https://lists.linux-foundation.org/mailman/listinfo/containers >
| |