On Thu, Jul 16, 2015 at 07:42:03PM -0500, Eric W. Biederman wrote: > Dave Chinner <da...@fromorbit.com> writes: > > > On Wed, Jul 15, 2015 at 11:47:08PM -0500, Eric W. Biederman wrote: > >> Casey Schaufler <ca...@schaufler-ca.com> writes: > >> > On 7/15/2015 6:08 PM, Andy Lutomirski wrote: > >> >> If I mount an unprivileged filesystem, then either the contents were > >> >> put there *by me*, in which case letting me access them are fine, or > >> >> (with Seth's patches and then some) I control the backing store, in > >> >> which case I can do whatever I want regardless of what LSM thinks. > >> >> > >> >> So I don't see the problem. Why would Smack or any other LSM care at > >> >> all, unless it wants to prevent me from mounting the fs in the first > >> >> place? > >> > > >> > First off, I don't cotton to the notion that you should be able > >> > to mount filesystems without privilege. But it seems I'm being > >> > outvoted on that. I suspect that there are cases where it might > >> > be safe, but I can't think of one off the top of my head. > >> > >> There are two fundamental issues mounting filesystems without privielge, > >> by which I actually mean mounting filesystems as the root user in a user > >> namespace. > >> > >> - Are the semantics safe. > >> - Is the extra attack surface a problem. > > > > I think the attack surface this exposes is the biggest problem > > facing this proposal. > > I completely agree. > > >> Figuring out how to make semantics safe is what we are talking about. > >> > >> Once we sort out the semantics we can look at the handful of filesystems > >> like fuse where the extra attack surface is not a concern. > >> > >> With that said desktop environments have for a long time been > >> automatically mounting whichever filesystem you place in your computer, > >> so in practice what this is really about is trying to align the kernel > >> with how people use filesystems. > > > > The key difference is that desktops only do this when you physically > > plug in a device. With unprivileged mounts, a hostile attacker > > doesn't need physical access to the machine to exploit lurking > > kernel filesystem bugs. i.e. they can just use loopback mounts, and > > they can keep mounting corrupted images until they find something > > that works. > > Yep. That magnifies the problem quite a bit. > > > User namespaces are supposed to provide trust separation. The > > kernel filesystems simply aren't hardened against unprivileged > > attacks from below - there is a trust relationship between root and > > the filesystem in that they are the only things that can write to > > the disk. Mounts from within a userns destroys this relationship as > > the userns root, by definition, is not a trusted actor. > > I talked to Ted Tso a while back and ext4 is at least in principle > already hardened against that kind of attack. I am not certain I > believe it, but if it is true I think it is fantastic.
Not sure what he said in private, but at the kernel summit last year what he said was not that it was "hardened", but that any bugs which would result from mounting a garbage image (i.e. an unpriv user fuzzing) would be deemed by him a real bug. As opposed to saying "don't do that". To the best of my knowledge that's so far only the case with Ted/ext4, which I assume is why Seth started with ext4. -serge -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
