[Devel] Re: [PATCH 4/6] cr: checkpoint and restore task credentials
Serge E. Hallyn
serue at us.ibm.com
Tue May 19 07:46:46 PDT 2009
Quoting David Howells (dhowells at redhat.com):
> Serge E. Hallyn <serue at us.ibm.com> wrote:
> > Or did you mean something else by 'fix up' cred->security?
> cred->security is inherited from the current process by virtue of calling
> prepare_creds() - as such, it is almost certainly going to be wrong. Can you
> just ask the LSM for a set of textual security labels when saving, and then
> set those back when restoring?
That would be too easy a way for users (even privileged root users but
constrained by selinux) to bypass selinux restrictions. All they'd have
to do is checkpoint their shell, and rewrite the ->security field in the
checkpoint image with 'shadow_t', to get a shell that can write to the
shadow file, for instance.
Containers mailing list
Containers at lists.linux-foundation.org
More information about the Devel