Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755277AbYCYMP0 (ORCPT ); Tue, 25 Mar 2008 08:15:26 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753651AbYCYMPO (ORCPT ); Tue, 25 Mar 2008 08:15:14 -0400 Received: from mummy.ncsc.mil ([144.51.88.129]:54898 "EHLO mummy.ncsc.mil" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753621AbYCYMPN (ORCPT ); Tue, 25 Mar 2008 08:15:13 -0400 Subject: Re: [PATCH] ptrace: it is fun to strace /sbin/init From: Stephen Smalley To: Oleg Nesterov Cc: Pavel Machek , Andrew Morton , "Eric W. Biederman" , Pavel Emelyanov , Roland McGrath , linux-kernel@vger.kernel.org, "Serge E. Hallyn" , Chris Wright In-Reply-To: <20080324230458.GA173@tv-sign.ru> References: <20080323135110.GA294@tv-sign.ru> <20080324160102.GB4069@atrey.karlin.mff.cuni.cz> <20080324164059.GA4767@tv-sign.ru> <20080324223925.GD2426@elf.ucw.cz> <20080324230458.GA173@tv-sign.ru> Content-Type: text/plain Organization: National Security Agency Date: Tue, 25 Mar 2008 08:03:57 -0400 Message-Id: <1206446637.3302.134.camel@moss-spartans.epoch.ncsc.mil> Mime-Version: 1.0 X-Mailer: Evolution 2.12.3 (2.12.3-3.fc8) Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1299 Lines: 33 On Tue, 2008-03-25 at 02:04 +0300, Oleg Nesterov wrote: > On 03/24, Pavel Machek wrote: > > > > > /sbin/init is important, but there are other important (and sometimes > > > much more important) services. Why it is so special so that we can't > > > debug/strace it? > > > > Maybe. Let's kill /sbin/init protection in 2.6.26. But making it > > optional is wrong. > > You are right, the boot parameter is silly. How about sysctl? > > Stephen, do you see any security problems if we make /sbin/init > ptraceable by default? Not an issue for SELinux (we apply an orthogonal check based on security context, so we can already block ptrace of init independent of whether root/CAP_SYS_PTRACE can do it). I'm not sure though as to whether people using capabilities have ever relied on this special protection of init (e.g. custom init spawns children with lesser capabilities and relies on the fact that they cannot ptrace init to effectively re-gain those capabilities, even if they possess CAP_SYS_PTRACE). -- Stephen Smalley National Security Agency -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/