Messages in this thread | | | From | (Eric W. Biederman) | Date | Fri, 18 Dec 2009 09:47:23 -0800 | Subject | Re: [PATCH 1/3] Security: Add prctl(PR_{GET,SET}_NETWORK) |
| |
Alan Cox <alan@lxorguk.ukuu.org.uk> writes:
>> the LSM-based version *does not* resolve the situation to my satisfaction as a >> userland hacker due to the well-known and long-standing adoption and >> compositionality problems facing small LSMs. ;) > > For things like Fedora it's probably an "interesting idea, perhaps we > should do it using SELinux" sort of problem, but a config option for a > magic network prctl is also going to be hard to adopt without producing a > good use case - and avoiding that by dumping crap into everyones kernel > fast paths isn't a good idea either.
If I understand the problem the goal is to disable access to ipc mechanism that don't have the usual unix permissions. To get something that is usable for non-root processes, and to get something that is widely deployed so you don't have to jump through hoops in end user applications to use it.
We have widely deployed mechanisms that are what you want or nearly what you want already in the form of the various namespaces built for containers.
I propose you introduce a permanent disable of executing suid applications.
After which point it is another trivial patch to allow unsharing of the network namespace if executing suid applications are disabled.
Eric
| |