lkml.org 
[lkml]   [2016]   [Jan]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    SubjectRe: [PATCH 2/2] sysctl: allow CLONE_NEWUSER to be disabled
    From
    Seems that Debian and some older Ubuntu versions are already using

    $ sysctl -a | grep usern
    kernel.unprivileged_userns_clone = 0

    Shall we be consistent wit it?

    2016-01-22 23:39 GMT+01:00 Kees Cook <keescook@chromium.org>:
    > There continues to be many CONFIG_USER_NS related security exposures.
    > For admins running distro kernels with CONFIG_USER_NS, there is no way
    > to disable CLONE_NEWUSER. As many systems do not need CLONE_NEWUSER,
    > this provides a way for sysadmins to disable the feature.
    >
    > This is inspired by a similar restriction in Grsecurity, but adds
    > a sysctl.
    >
    > Signed-off-by: Kees Cook <keescook@chromium.org>
    > ---
    > Documentation/sysctl/kernel.txt | 17 +++++++++++++++++
    > kernel/sysctl.c | 14 ++++++++++++++
    > kernel/user_namespace.c | 7 +++++++
    > 3 files changed, 38 insertions(+)
    >
    > diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
    > index bbfc5e339a3d..e9e8a4f949f5 100644
    > --- a/Documentation/sysctl/kernel.txt
    > +++ b/Documentation/sysctl/kernel.txt
    > @@ -85,6 +85,7 @@ show up in /proc/sys/kernel:
    > - tainted
    > - threads-max
    > - unknown_nmi_panic
    > +- userns_restrict
    > - watchdog
    > - watchdog_thresh
    > - version
    > @@ -933,6 +934,22 @@ example. If a system hangs up, try pressing the NMI switch.
    >
    > ==============================================================
    >
    > +userns_restrict:
    > +
    > +This toggle indicates whether CLONE_NEWUSER is available. As CLONE_NEWUSER
    > +has many unexpected side-effects and security exposures, this allows the
    > +sysadmin to disable the feature without needing to rebuild the kernel.
    > +
    > +When userns_restrict is set to (0), the default, there are no restrictions.
    > +
    > +When userns_restrict is set to (1), CLONE_NEWUSER is only available to
    > +processes that have CAP_SYS_ADMIN, CAP_SETUID, and CAP_SETGID.
    > +
    > +When userns_restrict is set to (2), CLONE_NEWUSER is not available at all,
    > +and the value is locked to "2" for the duration of the boot.
    > +
    > +==============================================================
    > +
    > watchdog:
    >
    > This parameter can be used to disable or enable the soft lockup detector
    > diff --git a/kernel/sysctl.c b/kernel/sysctl.c
    > index fc8899dd636d..ceb8b107fe28 100644
    > --- a/kernel/sysctl.c
    > +++ b/kernel/sysctl.c
    > @@ -112,6 +112,9 @@ extern int sysctl_nr_open_min, sysctl_nr_open_max;
    > #ifndef CONFIG_MMU
    > extern int sysctl_nr_trim_pages;
    > #endif
    > +#ifdef CONFIG_USER_NS
    > +extern int sysctl_userns_restrict;
    > +#endif
    >
    > /* Constants used for minimum and maximum */
    > #ifdef CONFIG_LOCKUP_DETECTOR
    > @@ -812,6 +815,17 @@ static struct ctl_table kern_table[] = {
    > .extra2 = &two,
    > },
    > #endif
    > +#ifdef CONFIG_USER_NS
    > + {
    > + .procname = "userns_restrict",
    > + .data = &sysctl_userns_restrict,
    > + .maxlen = sizeof(int),
    > + .mode = 0644,
    > + .proc_handler = proc_dointvec_minmax_cap_sysadmin,
    > + .extra1 = &zero,
    > + .extra2 = &two,
    > + },
    > +#endif
    > {
    > .procname = "ngroups_max",
    > .data = &ngroups_max,
    > diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
    > index 9bafc211930c..38395f9625ff 100644
    > --- a/kernel/user_namespace.c
    > +++ b/kernel/user_namespace.c
    > @@ -25,6 +25,7 @@
    >
    > static struct kmem_cache *user_ns_cachep __read_mostly;
    > static DEFINE_MUTEX(userns_state_mutex);
    > +int sysctl_userns_restrict __read_mostly;
    >
    > static bool new_idmap_permitted(const struct file *file,
    > struct user_namespace *ns, int cap_setid,
    > @@ -84,6 +85,12 @@ int create_user_ns(struct cred *new)
    > !kgid_has_mapping(parent_ns, group))
    > return -EPERM;
    >
    > + if (sysctl_userns_restrict == 2 ||
    > + (sysctl_userns_restrict == 1 && (!capable(CAP_SYS_ADMIN) ||
    > + !capable(CAP_SETUID) ||
    > + !capable(CAP_SETGID))))
    > + return -EPERM;
    > +
    > ns = kmem_cache_zalloc(user_ns_cachep, GFP_KERNEL);
    > if (!ns)
    > return -ENOMEM;
    > --
    > 2.6.3
    >



    --
    Robert Święcki

    \
     
     \ /
      Last update: 2016-01-23 00:21    [W:4.101 / U:0.728 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site