Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752329AbcKQUrk (ORCPT ); Thu, 17 Nov 2016 15:47:40 -0500 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:4727 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751959AbcKQUrh (ORCPT ); Thu, 17 Nov 2016 15:47:37 -0500 Date: Thu, 17 Nov 2016 21:47:07 +0100 From: Willy Tarreau To: "Eric W. Biederman" Cc: Linux Containers , Oleg Nesterov , "linux-kernel@vger.kernel.org" , "linux-mm@kvack.org" , Linux FS Devel , Michal Hocko , Jann Horn , Kees Cook , Andy Lutomirski Subject: Re: [REVIEW][PATCH 2/3] exec: Don't allow ptracing an exec of an unreadable file Message-ID: <20161117204707.GB10421@1wt.eu> References: <87y41kjn6l.fsf@xmission.com> <20161019172917.GE1210@laptop.thejh.net> <87pomwi5p2.fsf@xmission.com> <87pomwghda.fsf@xmission.com> <87twb6avk8.fsf_-_@xmission.com> <87inrmavax.fsf_-_@xmission.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87inrmavax.fsf_-_@xmission.com> User-Agent: Mutt/1.6.0 (2016-04-01) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1837 Lines: 39 On Thu, Nov 17, 2016 at 11:08:22AM -0600, Eric W. Biederman wrote: > > It is the reasonable expectation that if an executable file is not > readable there will be no way for a user without special privileges to > read the file. This is enforced in ptrace_attach but if we are > already attached there is no enforcement if a readonly executable > is exec'd. I'm really scared by this Eric. At least you want to make it a hardening option that can be disabled at run time, otherwise it can easily break a lot of userspace : admin@aloha:~$ ll /bin/bash /bin/coreutils /bin/ls /usr/bin/telnet -r-xr-x--x 1 root adm 549272 Oct 28 16:25 /bin/bash -rwx--x--x 1 root adm 765624 Oct 28 16:27 /bin/coreutils lrwxrwxrwx 1 root root 9 Oct 28 16:27 /bin/ls -> coreutils -r-xr-x--x 1 root adm 70344 Oct 28 16:34 /usr/bin/telnet And I've not invented it, I've being taught to do this more than 20 years ago and been doing this since on any slightly hardened server just because in pratice it's efficient at stopping quite a bunch of rootkits which require to copy and modify your executables. Sure they could get the contents using ptrace, but using cp is much more common than ptrace in scripts and that works. This has prooven quite efficient in field at stopping some rootkits several times over the last two decades and I know I'm not the only one to do it. In fact I *never* install an executable with read permissions for users if there's no need for random users to copy it. Does it mean that nobody should be able to see why their favorite utility doesn't work anymore ? Not in my opinion, at least not by default. So here I fear that we'll break strace at many places where strace precisely matters to debug things. However I'd love to have this feature controlled by a sysctl (to enforce it by default where possible). Thanks, Willy