Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752220AbdFLO1t (ORCPT ); Mon, 12 Jun 2017 10:27:49 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:56510 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751990AbdFLO1s (ORCPT ); Mon, 12 Jun 2017 10:27:48 -0400 Subject: Re: [PATCH v1] shebang: restrict python interactive prompt/interpreter From: Mimi Zohar To: =?ISO-8859-1?Q?Micka=EBl_Sala=FCn?= , Tetsuo Handa , keescook@chromium.org, matt@nmatt.com Cc: jason@perfinion.com, linux-security-module@vger.kernel.org, Daniel Micay , kernel-hardening , LKML Date: Mon, 12 Jun 2017 10:27:24 -0400 In-Reply-To: <1497234757.21594.280.camel@linux.vnet.ibm.com> References: <201706100041.GFH78616.OFtOHFJSLQOMVF@I-love.SAKURA.ne.jp> <754b78d1-f7f9-58bd-bf74-fea9e105649a@nmatt.com> <20170609164315.GA1141@meriadoc.perfinion.com> <201706101427.EEG90168.OtFFHSFMOVOJQL@I-love.SAKURA.ne.jp> <1497234757.21594.280.camel@linux.vnet.ibm.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.20.5 (3.20.5-1.fc24) Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-MML: disable x-cbid: 17061214-0052-0000-0000-00000254813E X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17061214-0053-0000-0000-000008329CD9 Message-Id: <1497277644.21594.319.camel@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-06-12_10:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1703280000 definitions=main-1706120251 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 938 Lines: 21 On Sun, 2017-06-11 at 22:32 -0400, Mimi Zohar wrote: > On Sun, 2017-06-11 at 13:44 +0200, Mickaël Salaün wrote: > > Using filesystem xattr seems like a good idea for this kind of > > exceptions and instead of a hardcoded interpreter path. Something like > > "security.tpe.interpreter=1|2" (bitmask for interpreter-only and/or CLI) > > and "security.tpe.environment=HOME,LOGNAME" would be quite flexible to > > configure a security policy for some binaries. This could also be > > protected by IMA/EVM, if needed. > > Checking for the existence of an xattr without caching is relatively > slow.  I'm not sure that we would want to go this route.   For identifying interpreters, xattrs would be too slow (without caching results), but once identified, using xattrs as you suggested, for specifying how interpreters can be invoked and limiting environment variables, is a good idea.  Perhaps the two xattrs could be combined? Mimi