lkml.org 
[lkml]   [2012]   [Jan]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH v2 0/4] PR_SET_NO_NEW_PRIVS, unshare, and chroot
    Date
    To make the no_new_privs discussion more concrete, here is an updated
    series that is actually useful. It adds PR_SET_NO_NEW_PRIVS with the
    same semantics as before (plus John Johansen's AppArmor fix and with
    improved bisectability). It then allows some unshare flags and chroot
    (sometimes) when no_new_privs is set.

    The unprivileged chroot could be quite useful, even though it's rather
    constrained for now.

    I think that blocking setresuid, setuid, and capset in no_new_privs mode
    will make this a little less useful. Comments are welcome.

    For the git-inclined, this series is here:
    https://git.kernel.org/?p=linux/kernel/git/luto/linux.git;a=shortlog;h=refs/heads/security/no_new_privs/patch_v2

    Test it like this:

    ---- begin test case

    #include <sys/prctl.h>
    #include <stdio.h>
    #include <unistd.h>
    #include <errno.h>

    #define PR_SET_NO_NEW_PRIVS 35
    #define PR_GET_NO_NEW_PRIVS 36

    int main()
    {
    int nnp = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
    if (nnp == -EINVAL) {
    printf("Failed!\n");
    return 1;
    }

    printf("nnp was %d\n", nnp);

    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
    printf("Failed!\n");
    return 1;
    }

    nnp = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
    if (nnp == -EINVAL) {
    printf("Failed!\n");
    return 1;
    }

    printf("nnp is %d\n", nnp);

    printf("here goes...\n");
    execlp("bash", "bash", NULL);
    printf("Failed to exec bash\n");
    return 1;
    }

    ---- end test case

    Andy Lutomirski (3):
    Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs
    Allow unprivileged CLONE_NEWUTS and CLONE_NEWIPC with no_new_privs
    Allow unprivileged chroot when safe

    John Johansen (1):
    Fix apparmor for PR_{GET,SET}_NO_NEW_PRIVS

    fs/exec.c | 10 +++++++++-
    fs/open.c | 16 ++++++++++++++--
    include/linux/prctl.h | 15 +++++++++++++++
    include/linux/sched.h | 2 ++
    include/linux/security.h | 1 +
    kernel/fork.c | 2 ++
    kernel/nsproxy.c | 8 +++++++-
    kernel/sys.c | 10 ++++++++++
    security/apparmor/domain.c | 35 +++++++++++++++++++++++++++++++++++
    security/commoncap.c | 7 +++++--
    security/selinux/hooks.c | 10 +++++++++-
    11 files changed, 109 insertions(+), 7 deletions(-)

    --
    1.7.7.5



    \
     
     \ /
      Last update: 2012-01-16 01:41    [W:0.022 / U:181.504 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site