Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752220AbbDBKMO (ORCPT ); Thu, 2 Apr 2015 06:12:14 -0400 Received: from bedivere.hansenpartnership.com ([66.63.167.143]:40350 "EHLO bedivere.hansenpartnership.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750714AbbDBKML (ORCPT ); Thu, 2 Apr 2015 06:12:11 -0400 Message-ID: <1427969525.3559.120.camel@HansenPartnership.com> Subject: Re: [PATCH] devpts: Add ptmx_uid and ptmx_gid options From: James Bottomley To: Alexander Larsson Cc: Andy Lutomirski , gnome-os-list@gnome.org, Linux Containers , "linux-kernel@vger.kernel.org" , mclasen@redhat.com, "Eric W. Biederman" , Linux FS Devel Date: Thu, 02 Apr 2015 13:12:05 +0300 In-Reply-To: <1427811444.4411.20.camel@redhat.com> References: <1427447013.2250.9.camel@HansenPartnership.com> <1427788642.4411.12.camel@redhat.com> <1427807248.2117.117.camel@HansenPartnership.com> <1427808184.2117.122.camel@HansenPartnership.com> <1427810118.2117.126.camel@HansenPartnership.com> <1427810886.2117.129.camel@HansenPartnership.com> <1427811444.4411.20.camel@redhat.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2007 Lines: 46 On Tue, 2015-03-31 at 16:17 +0200, Alexander Larsson wrote: > On tis, 2015-03-31 at 17:08 +0300, James Bottomley wrote: > > On Tue, 2015-03-31 at 06:59 -0700, Andy Lutomirski wrote: > > > > > > I don't think that this is correct. That user can already create a > > > nested userns and map themselves as 0 inside it. Then they can mount > > > devpts. > > > > I don't mind if they create a container and control the isolated ttys in > > that sub container in the VPS; that's fine. I do mind if they get > > access to the ttys in the VPS. > > > > If you can convince me (and the rest of Linux) that the tty subsystem > > should be mountable by an unprivileged user generally, then what you > > propose is OK. > > That is controlled by the general rights to mount stuff. I.e. unless you > have CAP_SYS_ADMIN in the VPS container you will not be able to mount > devpts there. You can only do it in a subcontainer where you got > permissions to mount via using user namespaces. OK let me try again. Fine, if you want to speak capabilities, you've given a non-root user an unexpected capability (the capability of creating a ptmx device). But you haven't used a capability separation to do this, you've just hard coded it via a mount parameter mechanism. If you want to do this thing, do it properly, so it's acceptable to the whole of Linux, not a special corner case for one particular type of container. Security breaches are created when people code in special, little used, corner cases because they don't get as thoroughly tested and inspected as generally applicable mechanisms. What you want is to be able to use the tty subsystem as a non root user: fine, but set that up globally, don't hide it in containers so a lot fewer people care. James -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/