lkml.org 
[lkml]   [2012]   [Jan]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH v2 0/4] PR_SET_NO_NEW_PRIVS, unshare, and chroot
Date
To make the no_new_privs discussion more concrete, here is an updated
series that is actually useful. It adds PR_SET_NO_NEW_PRIVS with the
same semantics as before (plus John Johansen's AppArmor fix and with
improved bisectability). It then allows some unshare flags and chroot
(sometimes) when no_new_privs is set.

The unprivileged chroot could be quite useful, even though it's rather
constrained for now.

I think that blocking setresuid, setuid, and capset in no_new_privs mode
will make this a little less useful. Comments are welcome.

For the git-inclined, this series is here:
https://git.kernel.org/?p=linux/kernel/git/luto/linux.git;a=shortlog;h=refs/heads/security/no_new_privs/patch_v2

Test it like this:

---- begin test case
#include <sys/prctl.h>
#include <stdio.h>
#include <unistd.h>
#include <errno.h>

#define PR_SET_NO_NEW_PRIVS 35
#define PR_GET_NO_NEW_PRIVS 36

int main()
{
int nnp = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
if (nnp == -EINVAL) {
printf("Failed!\n");
return 1;
}
printf("nnp was %d\n", nnp);

if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
printf("Failed!\n");
return 1;
}
nnp = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
if (nnp == -EINVAL) {
printf("Failed!\n");
return 1;
}
printf("nnp is %d\n", nnp);

printf("here goes...\n");
execlp("bash", "bash", NULL);
printf("Failed to exec bash\n");
return 1;
}
---- end test case
Andy Lutomirski (3):
Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs
Allow unprivileged CLONE_NEWUTS and CLONE_NEWIPC with no_new_privs
Allow unprivileged chroot when safe
John Johansen (1):
Fix apparmor for PR_{GET,SET}_NO_NEW_PRIVS
fs/exec.c | 10 +++++++++-
fs/open.c | 16 ++++++++++++++--
include/linux/prctl.h | 15 +++++++++++++++
include/linux/sched.h | 2 ++
include/linux/security.h | 1 +
kernel/fork.c | 2 ++
kernel/nsproxy.c | 8 +++++++-
kernel/sys.c | 10 ++++++++++
security/apparmor/domain.c | 35 +++++++++++++++++++++++++++++++++++
security/commoncap.c | 7 +++++--
security/selinux/hooks.c | 10 +++++++++-
11 files changed, 109 insertions(+), 7 deletions(-)
--
1.7.7.5



\
 
 \ /
  Last update: 2012-01-16 01:41    [from the cache]
©2003-2011 Jasper Spaans