Re: user ns: arbitrary module loading

2013-03-04 Thread Kees Cook
On Mon, Mar 4, 2013 at 10:21 AM, Eric W. Biederman wrote: > Kees Cook writes: > >> On Mon, Mar 4, 2013 at 12:29 AM, Mathias Krause >> wrote: >>> On Sun, Mar 03, 2013 at 09:48:50AM -0800, Kees Cook wrote: Several subsystems already have an implicit subsystem restriction because they lo

Re: user ns: arbitrary module loading

2013-03-04 Thread Eric W. Biederman
Kees Cook writes: > On Mon, Mar 4, 2013 at 12:29 AM, Mathias Krause > wrote: >> On Sun, Mar 03, 2013 at 09:48:50AM -0800, Kees Cook wrote: >>> Several subsystems already have an implicit subsystem restriction >>> because they load with aliases. (e.g. binfmt-, net-pf=NNN, >>> snd-card-NNN, F

Re: user ns: arbitrary module loading

2013-03-04 Thread Kees Cook
On Mon, Mar 4, 2013 at 12:29 AM, Mathias Krause wrote: > On Sun, Mar 03, 2013 at 09:48:50AM -0800, Kees Cook wrote: >> Several subsystems already have an implicit subsystem restriction >> because they load with aliases. (e.g. binfmt-, net-pf=NNN, >> snd-card-NNN, FOO-iosched, etc). This isn't

Re: user ns: arbitrary module loading

2013-03-04 Thread Mathias Krause
On Sun, Mar 03, 2013 at 09:48:50AM -0800, Kees Cook wrote: > Several subsystems already have an implicit subsystem restriction > because they load with aliases. (e.g. binfmt-, net-pf=NNN, > snd-card-NNN, FOO-iosched, etc). This isn't the case for filesystems > and a few others, unfortunately: >

Re: user ns: arbitrary module loading

2013-03-03 Thread Eric W. Biederman
Kees Cook writes: > On Sun, Mar 3, 2013 at 1:58 PM, Eric W. Biederman > wrote: > Ah-ha, thanks! Yes, that worked great. I think map_write()'s > cap_valid/ns_capable calls confused me. :) Yes permissions across user namespaces can be a little weird. But mostly if you are their creator, you ar

Re: user ns: arbitrary module loading

2013-03-03 Thread Kees Cook
On Sun, Mar 3, 2013 at 1:58 PM, Eric W. Biederman wrote: > Kees Cook writes: > >> On Sat, Mar 2, 2013 at 8:12 PM, Eric W. Biederman >> wrote: >>> "Serge E. Hallyn" writes: >>> Quoting Kees Cook (keesc...@google.com): > The rearranging done for user ns has resulted in allowing arbitrar

Re: user ns: arbitrary module loading

2013-03-03 Thread Eric W. Biederman
Kees Cook writes: > On Sat, Mar 2, 2013 at 8:12 PM, Eric W. Biederman > wrote: >> "Serge E. Hallyn" writes: >> >>> Quoting Kees Cook (keesc...@google.com): The rearranging done for user ns has resulted in allowing arbitrary kernel module loading[1] (i.e. re-introducing a form of CVE-

Re: user ns: arbitrary module loading

2013-03-03 Thread Kees Cook
On Sat, Mar 2, 2013 at 8:12 PM, Eric W. Biederman wrote: > "Serge E. Hallyn" writes: > >> Quoting Kees Cook (keesc...@google.com): >>> The rearranging done for user ns has resulted in allowing arbitrary >>> kernel module loading[1] (i.e. re-introducing a form of CVE-2011-1019) >>> by what is assu

Re: user ns: arbitrary module loading

2013-03-03 Thread Kees Cook
On Sat, Mar 2, 2013 at 7:56 PM, Serge E. Hallyn wrote: > Quoting Kees Cook (keesc...@google.com): >> On Sat, Mar 2, 2013 at 4:57 PM, Serge E. Hallyn wrote: >> > Quoting Kees Cook (keesc...@google.com): >> >> The rearranging done for user ns has resulted in allowing arbitrary >> >> kernel module l

Re: user ns: arbitrary module loading

2013-03-02 Thread Eric W. Biederman
"Serge E. Hallyn" writes: > Quoting Kees Cook (keesc...@google.com): >> The rearranging done for user ns has resulted in allowing arbitrary >> kernel module loading[1] (i.e. re-introducing a form of CVE-2011-1019) >> by what is assumed to be an unprivileged process. >> >> At present, it does loo

Re: user ns: arbitrary module loading

2013-03-02 Thread Serge E. Hallyn
Quoting Kees Cook (keesc...@google.com): > On Sat, Mar 2, 2013 at 4:57 PM, Serge E. Hallyn wrote: > > Quoting Kees Cook (keesc...@google.com): > >> The rearranging done for user ns has resulted in allowing arbitrary > >> kernel module loading[1] (i.e. re-introducing a form of CVE-2011-1019) > >> b

Re: user ns: arbitrary module loading

2013-03-02 Thread Kees Cook
On Sat, Mar 2, 2013 at 4:57 PM, Serge E. Hallyn wrote: > Quoting Kees Cook (keesc...@google.com): >> The rearranging done for user ns has resulted in allowing arbitrary >> kernel module loading[1] (i.e. re-introducing a form of CVE-2011-1019) >> by what is assumed to be an unprivileged process. >>

Re: user ns: arbitrary module loading

2013-03-02 Thread Serge E. Hallyn
Quoting Kees Cook (keesc...@google.com): > The rearranging done for user ns has resulted in allowing arbitrary > kernel module loading[1] (i.e. re-introducing a form of CVE-2011-1019) > by what is assumed to be an unprivileged process. > > At present, it does look to require at least CAP_SETUID al

user ns: arbitrary module loading

2013-03-01 Thread Kees Cook
The rearranging done for user ns has resulted in allowing arbitrary kernel module loading[1] (i.e. re-introducing a form of CVE-2011-1019) by what is assumed to be an unprivileged process. At present, it does look to require at least CAP_SETUID along the way to set up the uidmap (but things like t