lkml.org 
[lkml]   [2012]   [Jan]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] Add PR {GET,SET} NO NEW PRIVS to prevent exec ve from granting privs
-----Original Message-----
From: Jamie Lokier [jamie@shareable.org]
Received: Saturday, 14 Jan 2012, 8:56am
To: Andy Lutomirski [luto@amacapital.net]
CC: Linus Torvalds [torvalds@linux-foundation.org]; Alan Cox [alan@lxorguk.ukuu.org.uk]; Oleg Nesterov [oleg@redhat.com]; Will Drewry [wad@chromium.org]; linux-kernel@vger.kernel.org, keescook@chromium.org, john.johansen@canonical.com, serge.hallyn@canonical.com, coreyb@linux.vnet.ibm.com, pmoore@redhat.com, eparis@redhat.com, djm@mindrot.org, segoon@openwall.com, rostedt@goodmis.org, jmorris@namei.org, scarybeasts@gmail.com, avi@redhat.com, penberg@cs.helsinki.fi, viro@zeniv.linux.org.uk, luto@mit.edu, mingo@elte.hu, akpm@linux-foundation.org, khilman@ti.com, borislav.petkov@amd.com, amwang@redhat.com, ak@linux.intel.com, eric.dumazet@gmail.com, gregkh@suse.de, dhowells@redhat.com, daniel.lezcano@free.fr, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, olofj@chromium.org, mhalcrow@google.com, dlaor@redhat.com, corbet@lwn.net
Subject: Re: [PATCH] Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs

Andy Lutomirski wrote:

> Is the current exec_no_trans check enough for you? With my patch,
> selinux can already block the execve if it wants. (The policy is the
> same as it would be if a program explicitly asked to run the new
> executable with an unchanged security context.) I'd be happy to fail
> the exec in AppArmor, and then maybe AppArmor will change its mind
> if/when users get annoyed :)

Does SELinux block if userspace does exec entirely in userspace using
mmap() and not execve()? If not, why is execve() allowed to be different?

Yes, we do (or can, and usually do in policy)

\
 
 \ /
  Last update: 2012-01-14 16:23    [W:0.101 / U:0.304 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site