From: Paul Moore <paul@paul-moore.com>
To: "~akihirosuda" <suda.kyoto@gmail.com>
Cc: linux-kernel@vger.kernel.org, containers@lists.linux.dev,
serge@hallyn.com, brauner@kernel.org, ebiederm@xmission.com,
akihiro.suda.cz@hco.ntt.co.jp
Subject: Re: [PATCH linux 0/3] [PATCH] userns: add sysctl "kernel.userns_group_range"
Date: Tue, 30 May 2023 17:58:48 -0400 [thread overview]
Message-ID: <CAHC9VhQhBBPyZE24LM6KvYrET2huW-W_YYsyPndpNkn70Mu3Ug@mail.gmail.com> (raw)
In-Reply-To: <168547265011.24337.4306067683997517082-0@git.sr.ht>
On Tue, May 30, 2023 at 2:50 PM ~akihirosuda <akihirosuda@git.sr.ht> wrote:
>
> This sysctl limits groups who can create a new userns without
> CAP_SYS_ADMIN in the current userns, so as to mitigate potential kernel
> vulnerabilities around userns.
>
> The sysctl value format is same as "net.ipv4.ping_group_range".
>
> To disable creating new unprivileged userns, set the sysctl value to "1
> 0" in the initial userns.
>
> To allow everyone to create new userns, set the sysctl value to "0
> 4294967294". This is the default value.
>
> This sysctl replaces "kernel.unprivileged_userns_clone" that is found in
> Ubuntu [1] and Debian GNU/Linux.
>
> Link: https://git.launchpad.net/~ubuntu-
> kernel/ubuntu/+source/linux/+git/jammy/commit?id=3422764 [1]
Given the challenges around adding access controls to userns
operations, have you considered using the LSM support that was added
upstream last year? The relevant LSM hook can be found in commit
7cd4c5c2101c ("security, lsm: Introduce security_create_user_ns()"),
and although only SELinux currently provides an access control
implementation, there is no reason you couldn't add support for your
favorite LSM, or even just a simple BPF LSM to enforce the group
controls as you've described them here.
> Akihiro Suda (3):
> net/ipv4: split group_range logic to kernel/group_range.c
> group_range: allow GID from 2147483648 to 4294967294
> userns: add sysctl "kernel.userns_group_range"
>
> include/linux/group_range.h | 18 +++++
> include/linux/user_namespace.h | 5 ++
> include/net/netns/ipv4.h | 9 +--
> include/net/ping.h | 6 --
> kernel/Makefile | 2 +-
> kernel/fork.c | 24 +++++++
> kernel/group_range.c | 123 +++++++++++++++++++++++++++++++++
> kernel/sysctl.c | 30 ++++++++
> kernel/user.c | 9 +++
> net/ipv4/ping.c | 39 +----------
> net/ipv4/sysctl_net_ipv4.c | 56 ++-------------
> 11 files changed, 219 insertions(+), 102 deletions(-)
> create mode 100644 include/linux/group_range.h
> create mode 100644 kernel/group_range.c
--
paul-moore.com
next prev parent reply other threads:[~2023-05-30 21:58 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-30 18:50 [PATCH linux 0/3] [PATCH] userns: add sysctl "kernel.userns_group_range" ~akihirosuda
2023-05-30 11:34 ` [PATCH linux 3/3] " ~akihirosuda
2023-05-31 4:20 ` kernel test robot
2023-05-30 14:42 ` [PATCH linux 1/3] net/ipv4: split group_range logic to kernel/group_range.c ~akihirosuda
2023-05-30 17:31 ` [PATCH linux 2/3] group_range: allow GID from 2147483648 to 4294967294 ~akihirosuda
2023-05-30 21:58 ` Paul Moore [this message]
2023-05-31 7:50 ` [PATCH linux 0/3] [PATCH] userns: add sysctl "kernel.userns_group_range" Christian Brauner
2023-06-02 0:14 ` Eric W. Biederman
2023-06-02 1:01 ` Paul Moore
2023-06-02 1:41 ` Eric W. Biederman
2023-06-02 14:50 ` Paul Moore
2023-06-02 21:02 ` Akihiro Suda
2023-06-02 0:06 ` Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHC9VhQhBBPyZE24LM6KvYrET2huW-W_YYsyPndpNkn70Mu3Ug@mail.gmail.com \
--to=paul@paul-moore.com \
--cc=akihiro.suda.cz@hco.ntt.co.jp \
--cc=brauner@kernel.org \
--cc=containers@lists.linux.dev \
--cc=ebiederm@xmission.com \
--cc=linux-kernel@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=suda.kyoto@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).