To: daw-news@taverner.cs.berkeley.edu (David Wagner)
Cc: linux-kernel@vger.kernel.org
Subject: Re: RFC: disablenetwork facility. (v4)
References: <20091229050114.GC14362@heat> <m1y6km11lj.fsf@fess.ebiederm.org>
	<hhev6r$n8b$1@taverner.cs.berkeley.edu>
From: ebiederm@xmission.com (Eric W. Biederman)
Date: Fri, 01 Jan 2010 03:41:43 -0800
In-Reply-To: <hhev6r$n8b$1@taverner.cs.berkeley.edu> (David Wagner's message of "Wed\, 30 Dec 2009 07\:24\:11 +0000 \(UTC\)")
Message-ID: <m1ws02hx1k.fsf@fess.ebiederm.org>
User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1620
Lines: 37

daw@cs.berkeley.edu (David Wagner) writes:

> Eric W. Biederman wrote:
>>The problem with the disable_network semantics you want
>>is that they allow you to perform a denial of service attack
>>on privileged users.  An unprivileged DOS attack is unsuitable
>>for a general purpose feature in a general purpose kernel.
>
> I'm not persuaded yet.

I won't try hard to persuade you if you drop me off the cc list.

> When you talk about DOS, let's be a bit more precise.  disablenetwork
> gives a way to deny setuid programs access to the network.  It's not a
> general-purpose DOS; it's denying access to the network only.  And the
> network is fundamentally unreliable.  No security-critical mechanism
> should be relying upon the availability of the network.

The audit daemon should not rely on netlink?

> So while I certainly can't rule out the possibility that disablenetwork
> might introduce minor issues, I think there are fundamental reasons to
> be skeptical that disablenetwork will introduce serious new security
> problems.

For me the case is simple.  I have seen several plausible sounding
scenarios that get most of the way there.  I know I am stupid when
it comes to security and that people exploiting problems are going
to be looking harder than I will.  Therefore I think there is
a reasonable chance this will introduce a security hole for someone.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/