Re: [PATCH] Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs

[Eric Paris]

-----Original Message-----
From: Jamie Lokier [jamie@xxxxxxxxxxxxx]
Received: Saturday, 14 Jan 2012, 8:56am
To: Andy Lutomirski [luto@xxxxxxxxxxxxxx]
CC: Linus Torvalds [torvalds@xxxxxxxxxxxxxxxxxxxx]; Alan Cox [alan@xxxxxxxxxxxxxxxxxxx]; Oleg Nesterov [oleg@xxxxxxxxxx]; Will Drewry [wad@xxxxxxxxxxxx]; linux-kernel@xxxxxxxxxxxxxxx, keescook@xxxxxxxxxxxx, john.johansen@xxxxxxxxxxxxx, serge.hallyn@xxxxxxxxxxxxx, coreyb@xxxxxxxxxxxxxxxxxx, pmoore@xxxxxxxxxx, eparis@xxxxxxxxxx, djm@xxxxxxxxxxx, segoon@xxxxxxxxxxxx, rostedt@xxxxxxxxxxx, jmorris@xxxxxxxxx, scarybeasts@xxxxxxxxx, avi@xxxxxxxxxx, penberg@xxxxxxxxxxxxxx, viro@xxxxxxxxxxxxxxxxxx, luto@xxxxxxx, mingo@xxxxxxx, akpm@xxxxxxxxxxxxxxxxxxxx, khilman@xxxxxx, borislav.petkov@xxxxxxx, amwang@xxxxxxxxxx, ak@xxxxxxxxxxxxxxx, eric.dumazet@xxxxxxxxx, gregkh@xxxxxxx, dhowells@xxxxxxxxxx, daniel.lezcano@xxxxxxx, linux-fsdevel@xxxxxxxxxxxxxxx, linux-security-module@xxxxxxxxxxxxxxx, olofj@xxxxxxxxxxxx, mhalcrow@xxxxxxxxxx, dlaor@xxxxxxxxxx, corbet@xxxxxxx
Subject: Re: [PATCH] Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs

Andy Lutomirski wrote:

> Is the current exec_no_trans check enough for you?  With my patch,
> selinux can already block the execve if it wants.  (The policy is the
> same as it would be if a program explicitly asked to run the new
> executable with an unchanged security context.)  I'd be happy to fail
> the exec in AppArmor, and then maybe AppArmor will change its mind
> if/when users get annoyed :)

Does SELinux block if userspace does exec entirely in userspace using
mmap() and not execve()?  If not, why is execve() allowed to be different?

Yes, we do (or can, and usually do in policy)