Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754782AbdFWSef (ORCPT ); Fri, 23 Jun 2017 14:34:35 -0400 Received: from h2.hallyn.com ([78.46.35.8]:33254 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754327AbdFWSec (ORCPT ); Fri, 23 Jun 2017 14:34:32 -0400 Date: Fri, 23 Jun 2017 13:34:33 -0500 From: "Serge E. Hallyn" To: Stefan Berger Cc: James Bottomley , "Serge E. Hallyn" , Casey Schaufler , Amir Goldstein , "Eric W. Biederman" , Linux Containers , lkp@01.org, xiaolong.ye@intel.com, linux-kernel , Mimi Zohar , Tycho Andersen , christian.brauner@mailbox.org, Vivek Goyal , LSM List Subject: Re: [PATCH 0/3] Enable namespaced file capabilities Message-ID: <20170623183433.GB21137@mail.hallyn.com> References: <1498157989-11814-1-git-send-email-stefanb@linux.vnet.ibm.com> <20170623160026.GA18257@mail.hallyn.com> <20170623163030.GA18820@mail.hallyn.com> <1498237641.3641.15.camel@HansenPartnership.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2167 Lines: 44 Quoting Stefan Berger (stefanb@linux.vnet.ibm.com): > On 06/23/2017 01:07 PM, James Bottomley wrote: > >On Fri, 2017-06-23 at 11:30 -0500, Serge E. Hallyn wrote: > >>Quoting Casey Schaufler (casey@schaufler-ca.com): > >>>Or maybe just security.ns.capability, taking James' comment into > >>>account. > >>That last one may be suitable as an option, useful for his particular > >>(somewhat barbaric :) use case, but it's not ok for the general > >>solution. > >> > >>If uid 1000 was delegated the subuids 100000-199999, it should be > >>able to write a file capability for use by his subuids, but that file > >>capability must not apply to other subuids. > >I don't think it's barbaric, I think it's the common use case. Let me > >give a more comprehensible answer in terms of docker and IMA. Lets > >suppose I'm running docker locally and in a test cloud both with userns > >enabled. > > > >I build an image locally, mapping my uid (1000) to root. If I begin > >with a standard base, each of the files has a security.ima signature. > > Now I add my layer, which involves updating a file, so I need to write > >a new signature to security.ima. Because I'm running user namespaced, > >the update gets written at security.ima@uid=1000 when I do a docker > >save. > > > >Now supposing I deploy that image to a cloud. As a tenant, the cloud > >gives me real uid 4531 and maps that to root. Execution of the binary > >fails because it tries to use the underlying signature (in > >security.ima) as there is no xattr named security.ima@uid=4531 > > Yes. An answer would be to have Docker rewrite these on the fly. It > knows what uid the container was running as and specifically looks > for security.ima@uid=1000 or security.ima, takes the former if it > finds, otherwise the latter or nothing. I know many people hate this answer, but I just want to point out that on my little laptop, while untarring a 500M images takes 9.5 seconds, remapping all uids and gids and restoring setuid+setgid on that image takes .01s. It's high cpu utilization, and it's not zero time, but it's very fast, and it's 100% safe (when done the right way, not "sudo domychown"). -serge