Received-SPF: pass (google.com: domain of linux-kernel+bounces-155590-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
From: Andy Lutomirski <luto@amacapital.net>
Precedence: bulk
Mime-Version: 1.0 (1.0)
Subject: Re: [PATCH v2 0/2] implement OA2_INHERIT_CRED flag for openat2()
Date: Tue, 23 Apr 2024 09:44:50 -0700
Message-Id: <4D2A1543-273F-417F-921B-E9F994FBF2E8@amacapital.net>
References: <20240423110148.13114-1-stsp2@yandex.ru>
Cc: linux-kernel@vger.kernel.org, Stefan Metzmacher <metze@samba.org>,
 Eric Biederman <ebiederm@xmission.com>,
 Alexander Viro <viro@zeniv.linux.org.uk>,
 Andy Lutomirski <luto@kernel.org>, Christian Brauner <brauner@kernel.org>,
 Jan Kara <jack@suse.cz>, Jeff Layton <jlayton@kernel.org>,
 Chuck Lever <chuck.lever@oracle.com>,
 Alexander Aring <alex.aring@gmail.com>, linux-fsdevel@vger.kernel.org,
 linux-api@vger.kernel.org, Paolo Bonzini <pbonzini@redhat.com>,
 =?utf-8?Q?Christian_G=C3=B6ttsche?= <cgzones@googlemail.com>
In-Reply-To: <20240423110148.13114-1-stsp2@yandex.ru>
To: Stas Sergeev <stsp2@yandex.ru>


> On Apr 23, 2024, at 4:02=E2=80=AFAM, Stas Sergeev <stsp2@yandex.ru> wrote:=

>=20
> =EF=BB=BFThis patch-set implements the OA2_INHERIT_CRED flag for openat2()=
 syscall.
> It is needed to perform an open operation with the creds that were in
> effect when the dir_fd was opened. This allows the process to pre-open
> some dirs and switch eUID (and other UIDs/GIDs) to the less-privileged
> user, while still retaining the possibility to open/create files within
> the pre-opened directory set.

I like the concept, as it=E2=80=99s a sort of move toward a capability syste=
m. But I think that making a dirfd into this sort of capability would need t=
o be much more explicit. Right now, any program could do this entirely by ac=
cident, and applying OA2_INHERIT_CRED to an fd fished out of /proc seems haz=
ardous.

So perhaps if an open file description for a directory could have something l=
ike FMODE_CRED, and if OA2_INHERIT_CRED also blocked .., magic links, symlin=
ks to anywhere above the dirfd (or maybe all symlinks) and absolute path loo=
kups, then this would be okay.

Also, there are lots of ways that f_cred could be relevant: fsuid/fsgid, eff=
ective capabilities and security labels. And it gets more complex if this ev=
er gets extended to support connecting or sending to a socket or if someone o=
pens a device node.  Does CAP_SYS_ADMIN carry over?

>=20
> Changes in v2:
> - capture full struct cred instead of just fsuid/fsgid.
>  Suggested by Stefan Metzmacher <metze@samba.org>
>=20
> CC: Stefan Metzmacher <metze@samba.org>
> CC: Eric Biederman <ebiederm@xmission.com>
> CC: Alexander Viro <viro@zeniv.linux.org.uk>
> CC: Andy Lutomirski <luto@kernel.org>
> CC: Christian Brauner <brauner@kernel.org>
> CC: Jan Kara <jack@suse.cz>
> CC: Jeff Layton <jlayton@kernel.org>
> CC: Chuck Lever <chuck.lever@oracle.com>
> CC: Alexander Aring <alex.aring@gmail.com>
> CC: linux-fsdevel@vger.kernel.org
> CC: linux-kernel@vger.kernel.org
> CC: linux-api@vger.kernel.org
> CC: Paolo Bonzini <pbonzini@redhat.com>
> CC: Christian G=C3=B6ttsche <cgzones@googlemail.com>
>=20
> Stas Sergeev (2):
>  fs: reorganize path_openat()
>  openat2: add OA2_INHERIT_CRED flag
>=20
> fs/internal.h                |  2 +-
> fs/namei.c                   | 52 +++++++++++++++++++++++++++++-------
> fs/open.c                    |  2 +-
> include/linux/fcntl.h        |  2 ++
> include/uapi/linux/openat2.h |  3 +++
> 5 files changed, 50 insertions(+), 11 deletions(-)
>=20
> --
> 2.44.0
>=20
>=20