Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751215AbbHADsU (ORCPT ); Fri, 31 Jul 2015 23:48:20 -0400 Received: from h2.hallyn.com ([78.46.35.8]:51391 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750789AbbHADsS (ORCPT ); Fri, 31 Jul 2015 23:48:18 -0400 Date: Fri, 31 Jul 2015 22:48:16 -0500 From: "Serge E. Hallyn" To: Lukasz Pawelczyk Cc: "Serge E. Hallyn" , "Eric W. Biederman" , Al Viro , Alexey Dobriyan , Andrew Morton , Andy Lutomirski , Arnd Bergmann , Casey Schaufler , David Howells , Eric Dumazet , Eric Paris , Fabian Frederick , Greg KH , James Morris , Jiri Slaby , Joe Perches , John Johansen , Jonathan Corbet , Kees Cook , Mauro Carvalho Chehab , NeilBrown , Oleg Nesterov , Paul Moore , Stephen Smalley , Tetsuo Handa , Zefan Li , linux-doc@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, havner@gmail.com Subject: Re: [PATCH v3 01/11] user_ns: 3 new LSM hooks for user namespace operations Message-ID: <20150801034816.GA5541@mail.hallyn.com> References: <1437732285-11524-1-git-send-email-l.pawelczyk@samsung.com> <1437732285-11524-2-git-send-email-l.pawelczyk@samsung.com> <20150730213059.GA13589@mail.hallyn.com> <1438334936.2081.6.camel@samsung.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1438334936.2081.6.camel@samsung.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2053 Lines: 50 On Fri, Jul 31, 2015 at 11:28:56AM +0200, Lukasz Pawelczyk wrote: > On czw, 2015-07-30 at 16:30 -0500, Serge E. Hallyn wrote: > > On Fri, Jul 24, 2015 at 12:04:35PM +0200, Lukasz Pawelczyk wrote: > > > @@ -969,6 +982,7 @@ static int userns_install(struct nsproxy > > > *nsproxy, struct ns_common *ns) > > > { > > > struct user_namespace *user_ns = to_user_ns(ns); > > > struct cred *cred; > > > + int err; > > > > > > /* Don't allow gaining capabilities by reentering > > > * the same user namespace. > > > @@ -986,6 +1000,10 @@ static int userns_install(struct nsproxy > > > *nsproxy, struct ns_common *ns) > > > if (!ns_capable(user_ns, CAP_SYS_ADMIN)) > > > return -EPERM; > > > > > > + err = security_userns_setns(nsproxy, user_ns); > > > + if (err) > > > + return err; > > > > So at this point the LSM thinks current is in the new ns. If > > prepare_creds() fails below, should it be informed of that? > > (Or am I over-thinking this?) > > > > > + > > > cred = prepare_creds(); > > > if (!cred) > > > return -ENOMEM; > > Hmm, the use case for this hook I had in mind was just to allow or > disallow the operation based on the information passed in arguments. > Not to register the current in any way so LSM can think it is or isn't > in the new namespace. > > I think that any other LSM check that would like to know in what > namespace the current is, would just check that from current's creds. > Not use some stale and duplicated information the above hook could have > registered. > > I see no reason for this hook to change the LSM state, only to answer > the question: allowed/disallowed (eventually return an error cause it > is unable to give an answer which falls into the disallow category). How about renaming it "security_userns_may_setns()" for clarity? -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/