Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp4129439yba; Wed, 17 Apr 2019 05:20:44 -0700 (PDT) X-Google-Smtp-Source: APXvYqzNmhLBrhn9vSjiW4PV7+VGoQ2iWI1B/APL9nWVQnp4uwguAEKb0ZZ3g/lznjycSdkaZCT/ X-Received: by 2002:a17:902:7e05:: with SMTP id b5mr89607476plm.127.1555503644218; Wed, 17 Apr 2019 05:20:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1555503644; cv=none; d=google.com; s=arc-20160816; b=htgCu5fEBI4KnQn74ircWwyrBI7TiFRXxWK9OFZ94TB8+XXWqDcKVVHyOhklzhU0aY JbuU6xlYvQssmca2xRG+VSTHxe+6MW1f30ojalW5TRlWRDr3Y4oMqJYaVtRnbJxRb3nh quKQB5TcPNBo0nAmLzVJ7lK3vpdkk+9Q6l2NGe71g2QbG36hK1VkKpjz7T0PuoMckkIP MlSG4pgQydz2+g5tNxfAvhn/WX9KZX5p0VnFhMi0Tgp1iRHiVh+7axsPx7C11o9I3PW8 NnW03a+o7PIiMxL/M9FTdLmCOGiYFBcpx4lNRgxK2UIwAfNBjCcyYL8y++WEBZRY4QZ3 XTyw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:message-id :in-reply-to:date:references:subject:cc:to:from; bh=jvDXMx9N8U4mmddbrrfVCv8y0Sx6QXlgIbxCQ+wUwgw=; b=YpnTT5ZqDQdjfd4PW8MP/NloZBy774/EnaySaoUnMW7HOZQHhzeffDWWN8zsp48Gf7 BHvmxrhVOr5M+1KeCikQLNKh1cP7yBJf6ggF6snHEwZi2TbOFqQYg0dfgn0OZ6Pls002 QYiGB/C+LOEOfas7r9k1pkKazdV58wFQfqldV+2pLF8PO4q+1EkS0pc2PKBkArzxDjaE /55egJ9U2ZmQNQHFcZvtQaZDlQI6KOFgMNdHdkxj4QFF174VzEXIm4lssp7ZJ7CQfOSB PcckknSGIkJybCqE5xyQwp/RFSyjtO6UaAyDY7uZnzoPvfcEEQwG6PN+hcQfOcdMHNkX CC/g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id v22si34747137pfm.151.2019.04.17.05.20.28; Wed, 17 Apr 2019 05:20:44 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731958AbfDQMTj (ORCPT + 99 others); Wed, 17 Apr 2019 08:19:39 -0400 Received: from mx1.redhat.com ([209.132.183.28]:31606 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726708AbfDQMTi (ORCPT ); Wed, 17 Apr 2019 08:19:38 -0400 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id C8E9D3084295; Wed, 17 Apr 2019 12:19:37 +0000 (UTC) Received: from oldenburg2.str.redhat.com (dhcp-192-219.str.redhat.com [10.33.192.219]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 207A960143; Wed, 17 Apr 2019 12:19:30 +0000 (UTC) From: Florian Weimer To: Andy Lutomirski Cc: Aleksa Sarai , "Enrico Weigelt\, metux IT consult" , Christian Brauner , Linus Torvalds , Al Viro , Jann Horn , David Howells , Linux API , LKML , "Serge E. Hallyn" , Arnd Bergmann , "Eric W. Biederman" , Kees Cook , Thomas Gleixner , Michael Kerrisk , Andrew Morton , Oleg Nesterov , Joel Fernandes , Daniel Colascione Subject: Re: RFC: on adding new CLONE_* flags [WAS Re: [PATCH 0/4] clone: add CLONE_PIDFD] References: <20190414201436.19502-1-christian@brauner.io> <20190415195911.z7b7miwsj67ha54y@yavin> Date: Wed, 17 Apr 2019 14:19:29 +0200 In-Reply-To: (Andy Lutomirski's message of "Mon, 15 Apr 2019 13:29:23 -0700") Message-ID: <87v9zc6cz2.fsf@oldenburg2.str.redhat.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.40]); Wed, 17 Apr 2019 12:19:38 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org * Andy Lutomirski: > I would personally *love* it if distros started setting no_new_privs > for basically all processes. Wouldn't no_new_privs inhibit all security transitions, including those that reduce privileges? And therefore effectively reduce security? > Anyway, clone(2) is an enormous mess. Surely the right solution here > is to have a whole new process creation API that takes a big, > extensible struct as an argument, and supports *at least* the full > abilities of posix_spawn() and ideally covers all the use cases for > fork() + do stuff + exec(). It would be nifty if this API also had a > way to say "add no_new_privs and therefore enable extra functionality > that doesn't work without no_new_privs". This functionality would > include things like returning a future extra-privileged pidfd that > gives ptrace-like access. I agree that consistent replacement for the clone system call makes sense. I'm not sure if covering everything that posix_spawn could do would make sense. There seems to be some demand to be able to do large parts of container setup using posix_spawn, so we'll probably add support for things like writing to arbitrary files eventually. And of course, proper error reporting, so that you can figure out which file creation action failed. Thanks, Florian