Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754072Ab0AJV67 (ORCPT ); Sun, 10 Jan 2010 16:58:59 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1754050Ab0AJV66 (ORCPT ); Sun, 10 Jan 2010 16:58:58 -0500 Received: from atrey.karlin.mff.cuni.cz ([195.113.26.193]:55249 "EHLO atrey.karlin.mff.cuni.cz" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753631Ab0AJV65 (ORCPT ); Sun, 10 Jan 2010 16:58:57 -0500 Date: Sun, 10 Jan 2010 22:58:48 +0100 From: Pavel Machek To: Michael Stone Cc: James Morris , linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-security-module@vger.kernel.org, Andi Kleen , David Lang , Oliver Hartkopp , Alan Cox , Herbert Xu , Valdis Kletnieks , Bryan Donlan , Evgeniy Polyakov , "C. Scott Ananian" , "Eric W. Biederman" , Bernie Innocenti , Mark Seaborn , Randy Dunlap , =?iso-8859-1?Q?Am=E9rico?= Wang , Tetsuo Handa , Samir Bellabes , Casey Schaufler , "Serge E. Hallyn" , Al Viro Subject: Re: [PATCH 2/3] Security: Implement disablenetwork semantics. (v4) Message-ID: <20100110215848.GA26609@elf.ucw.cz> References: <20100110215409.GA3705@heat> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20100110215409.GA3705@heat> X-Warning: Reading this can be dangerous to your mental health. User-Agent: Mutt/1.5.20 (2009-06-14) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2224 Lines: 54 On Sun 2010-01-10 16:54:09, Michael Stone wrote: > On Fri, 1 Jan 2010, Pavel Machek wrote: > > >> > Quoting Michael Stone (michael@laptop.org): > >> > > Implement security_* hooks for socket_create, socket_bind, socket_connect, > >> > > socket_sendmsg, and ptrace_access_check which return -EPERM when called from a > >> > > process with networking restrictions. Exempt AF_UNIX sockets. > >> > > > > > Signed-off-by: Michael Stone > >> > > > Acked-by: Serge Hallyn > >> > For the record: NAK, as it introduces security holes. > > > >Please elaborate. > > Pavel's position is that disablenetwork is likely to permit some attacker > somewhere to deny network access to some setuid app some day in a way that > violates some security policy. > > He has mentioned specific concern over scenarios like: Make that scenario 1. > Alice configures PAM auth to 'fail open' by checking login credentials > against a restrictive LDAP server and, if the server is unavailable, against > a very permissive files database. Scenario 2: Mallory calls disablenetwork, calls sendmail as the first user after boot; sendmail can't deliver anything (its network is disabled), but starts forking and taking requests for other users, DoSing the mail delivery. Scenario 3: Mallory calls disablenetwork, then keeps hammering on su, knowing that su can no longer send data to audit subsystem and so he will not get caught. > My position is that better isolation facilities like disablenetwork will > prevent far more grievous security faults than they (theoretically) cause. You can trivialy make disablenetwork disable setuid exec, too. That will introduce better isolation facilities, but not introduce any new security problems. For some reason, you don't want to do the obviously right thing. Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/