Re: [PATCH] Security: Implement and document RLIMIT_NETWORK. (fwd)

James Morris [off-list ref] writes:

Would you be able to help answer these queries on the list?

I'm not sure what the network namespace semantics are in (2) below.

---------- Forwarded message ----------
Date: Wed, 7 Jan 2009 22:34:54 -0500
From: Michael Stone <redacted>
To: James Morris <jmorris@namei.org>
Cc: linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
    linux-security-module@vger.kernel.org
Subject: Re: [PATCH] Security: Implement and document RLIMIT_NETWORK.

On Thu, Jan 08, 2009 at 12:22:17PM +1100, James Morris wrote:

quoted

Have you considered utilizing network namespaces [1] ?  A process created with
a private network namespace has no network interfaces configured, except
loopback, which is down.  Does this do what you want?  The launcher could
optionally allow local IP by bringing up the loopback interface.

James,

This net-namespaces work sounds quite apropos to some of my other
projects but I'm having trouble figuring out whether it can be used to
solve my current problem. Two questions which immediately occur to me
include:

 1) As with the netfilter suggestions provided by Andi and Evgeniy, it
 seems that processes require special privileges (e.g. CAP_NET_ADMIN) in
 order to drop network privileges by means of entering a new net
 namespace. Is this correct? If so, why is it necessary or appropriate?

Yes.

Mostly general paranoia.  The problem is that the process could later
exec a suid root executable.  Potentially that suid root executable
could be fooled into a breach of security (such as not logging audit
records) because it is running in a network namespace.

The classic example of this class of exploits is using a mount
namespace to replace libc or /etc/passwd.  Both of which can lead
to privilege escalation.

I'm not creative enough at the moment to see how that class of exploits
would apply to a network namespace, but that is the reasoning for
requiring privilege.  

Let's see.  Having a network namespace namespace could allow you
to impersonate the local X server and steal a more privileged
users authentication tokens, provided by a suid binary.

 2) What happens if I call unshare(CLONE_NEWNET) after I've bound some
 sockets to an address or connected some sockets to remote endpoints?

All sockets are associated with a network namespace, and they don't change
when an unshare happens.  Accept still continues to work, and create
new sockets in the original network namespace.

However all calls to socket and to socketpair create new sockets that are
limited to living in the processes default network namespace.

Perhaps you can help straighten me out, e.g. by pointing me at the
relevant code?

Eric