Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2016-01-05 Thread Eric W. Biederman
Andy Lutomirski writes: > On Tue, Jan 5, 2016 at 5:17 PM, Eric W. Biederman > wrote: >> Josh Boyer writes: >> >>> On Sat, Dec 26, 2015 at 9:03 PM, Andy Lutomirski >>> wrote: On Sat, Dec 26, 2015 at 1:51 PM, Serge E. Hallyn wrote: > On Sat, Dec 26, 2015 at 03:52:31AM +0100, Jan

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2016-01-05 Thread Andy Lutomirski
On Tue, Jan 5, 2016 at 5:17 PM, Eric W. Biederman wrote: > Josh Boyer writes: > >> On Sat, Dec 26, 2015 at 9:03 PM, Andy Lutomirski wrote: >>> On Sat, Dec 26, 2015 at 1:51 PM, Serge E. Hallyn >>> wrote: On Sat, Dec 26, 2015 at 03:52:31AM +0100, Jann Horn wrote: > ptrace_has_cap() check

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2016-01-05 Thread Eric W. Biederman
Josh Boyer writes: > On Sat, Dec 26, 2015 at 9:03 PM, Andy Lutomirski wrote: >> On Sat, Dec 26, 2015 at 1:51 PM, Serge E. Hallyn >> wrote: >>> On Sat, Dec 26, 2015 at 03:52:31AM +0100, Jann Horn wrote: ptrace_has_cap() checks whether the current process should be treated as having a c

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2016-01-04 Thread Josh Boyer
On Sat, Dec 26, 2015 at 9:03 PM, Andy Lutomirski wrote: > On Sat, Dec 26, 2015 at 1:51 PM, Serge E. Hallyn > wrote: >> On Sat, Dec 26, 2015 at 03:52:31AM +0100, Jann Horn wrote: >>> ptrace_has_cap() checks whether the current process should be >>> treated as having a certain capability for ptrace

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2015-12-26 Thread Andy Lutomirski
On Sat, Dec 26, 2015 at 1:51 PM, Serge E. Hallyn wrote: > On Sat, Dec 26, 2015 at 03:52:31AM +0100, Jann Horn wrote: >> ptrace_has_cap() checks whether the current process should be >> treated as having a certain capability for ptrace checks >> against another process. Until now, this was equivale

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2015-12-26 Thread Serge E. Hallyn
On Sat, Dec 26, 2015 at 03:52:31AM +0100, Jann Horn wrote: > ptrace_has_cap() checks whether the current process should be > treated as having a certain capability for ptrace checks > against another process. Until now, this was equivalent to > has_ns_capability(current, target_ns, CAP_SYS_PTRACE).

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2015-12-26 Thread Serge E. Hallyn
On Sat, Dec 26, 2015 at 10:27:33PM +0100, Jann Horn wrote: > On Sat, Dec 26, 2015 at 03:17:29PM -0600, Serge E. Hallyn wrote: > > On Sat, Dec 26, 2015 at 03:52:31AM +0100, Jann Horn wrote: > > > ptrace_has_cap() checks whether the current process should be > > > treated as having a certain capabili

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2015-12-26 Thread Jann Horn
On Sat, Dec 26, 2015 at 03:17:29PM -0600, Serge E. Hallyn wrote: > On Sat, Dec 26, 2015 at 03:52:31AM +0100, Jann Horn wrote: > > ptrace_has_cap() checks whether the current process should be > > treated as having a certain capability for ptrace checks > > against another process. Until now, this w

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2015-12-26 Thread Serge E. Hallyn
On Sat, Dec 26, 2015 at 03:52:31AM +0100, Jann Horn wrote: > ptrace_has_cap() checks whether the current process should be > treated as having a certain capability for ptrace checks > against another process. Until now, this was equivalent to > has_ns_capability(current, target_ns, CAP_SYS_PTRACE).

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2015-12-26 Thread Serge E. Hallyn
On Sat, Dec 26, 2015 at 09:55:50PM +0100, Jann Horn wrote: > On Sat, Dec 26, 2015 at 02:23:45PM -0600, Serge E. Hallyn wrote: > > On Sat, Dec 26, 2015 at 02:10:38AM +0100, Jann Horn wrote: > > > On Sat, Dec 12, 2015 at 09:12:41PM +0100, Jann Horn wrote: > > > > With this change, the entering proces

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2015-12-26 Thread Jann Horn
On Sat, Dec 26, 2015 at 02:23:45PM -0600, Serge E. Hallyn wrote: > On Sat, Dec 26, 2015 at 02:10:38AM +0100, Jann Horn wrote: > > On Sat, Dec 12, 2015 at 09:12:41PM +0100, Jann Horn wrote: > > > With this change, the entering process can first enter the > > > namespace and then safely inspect the n

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2015-12-26 Thread Serge E. Hallyn
On Sat, Dec 26, 2015 at 02:10:38AM +0100, Jann Horn wrote: > On Sat, Dec 12, 2015 at 09:12:41PM +0100, Jann Horn wrote: > > With this change, the entering process can first enter the > > namespace and then safely inspect the namespace's > > properties, e.g. through /proc/self/{uid_map,gid_map}, > >

[PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2015-12-25 Thread Jann Horn
ptrace_has_cap() checks whether the current process should be treated as having a certain capability for ptrace checks against another process. Until now, this was equivalent to has_ns_capability(current, target_ns, CAP_SYS_PTRACE). However, if a root-owned process wants to enter a user namespace

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2015-12-25 Thread Jann Horn
On Sat, Dec 12, 2015 at 09:12:41PM +0100, Jann Horn wrote: > With this change, the entering process can first enter the > namespace and then safely inspect the namespace's > properties, e.g. through /proc/self/{uid_map,gid_map}, > assuming that the namespace owner doesn't have access to > uid 0. A

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2015-12-17 Thread Serge E. Hallyn
On Sat, Dec 12, 2015 at 09:12:41PM +0100, Jann Horn wrote: > ptrace_has_cap() checks whether the current process should be > treated as having a certain capability for ptrace checks > against another process. Until now, this was equivalent to > has_ns_capability(current, target_ns, CAP_SYS_PTRACE).

Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2015-12-14 Thread Andy Lutomirski
On Sat, Dec 12, 2015 at 12:12 PM, Jann Horn wrote: > ptrace_has_cap() checks whether the current process should be > treated as having a certain capability for ptrace checks > against another process. Until now, this was equivalent to > has_ns_capability(current, target_ns, CAP_SYS_PTRACE). > > Ho

[PATCH] ptrace: being capable wrt a process requires mapped uids/gids

2015-12-12 Thread Jann Horn
ptrace_has_cap() checks whether the current process should be treated as having a certain capability for ptrace checks against another process. Until now, this was equivalent to has_ns_capability(current, target_ns, CAP_SYS_PTRACE). However, if a root-owned process wants to enter a user namespace