From owner-freebsd-arch@freebsd.org Fri Nov 27 05:04:29 2020 Return-Path: Delivered-To: freebsd-arch@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 0E63747CEF4; Fri, 27 Nov 2020 05:04:29 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [96.47.72.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Cj2bw6q0rz4b3C; Fri, 27 Nov 2020 05:04:28 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: from mail-qk1-f174.google.com (mail-qk1-f174.google.com [209.85.222.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) (Authenticated sender: kevans) by smtp.freebsd.org (Postfix) with ESMTPSA id D852A293DD; Fri, 27 Nov 2020 05:04:28 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: by mail-qk1-f174.google.com with SMTP id x25so3434308qkj.3; Thu, 26 Nov 2020 21:04:28 -0800 (PST) X-Gm-Message-State: AOAM533kPKvIdL+qldjOIlRRJUqvF8cM+XjK+sIwOxWKe++YdxF7z92j 8J4NiQqp8Dh4Ibr/q9dz32XNc6JRK982fWeEVP8= X-Google-Smtp-Source: ABdhPJxlkh6mA3c4sZnghdfJ8mFhjgAtHtO7tAvTV5dRAPiCpuTVFNbC41qd2SROTd80g2h3UllI/b6tsAsqVkDw+h4= X-Received: by 2002:a37:9ecc:: with SMTP id h195mr6748565qke.103.1606453468362; Thu, 26 Nov 2020 21:04:28 -0800 (PST) MIME-Version: 1.0 From: Kyle Evans Date: Thu, 26 Nov 2020 23:04:17 -0600 X-Gmail-Original-Message-ID: Message-ID: Subject: RFC: Jail privsets To: freebsd-jail , "freebsd-arch@freebsd.org" Content-Type: text/plain; charset="UTF-8" X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Nov 2020 05:04:29 -0000 (Cross-posting to -arch and -jail for maximum reach) Hi, A couple of times recently, I've had a need or desire to increase or decrease privileges available to jails I create to some extent. You can write a MAC policy for this, but at some point the downsides of MAC policies for this became clear: it's either non-trivial to allow the kind of flexibility you may need in configuring some of these jails, and you have to rebuild the module otherwise. I've got a generally functional patch at [1] that is an approach I'd like to request comments on for refining jail privileges. It creates a privset that can be assigned on a per-jail basis, and a creator with PRIV_JAIL_SETPRIVS can specify any privset mask that's a subset of the parent prison. If no privset was specified at creation time, then we use the default logic that was previously in prison_priv_check(). prison_priv_check() has been replaced with a much simpler check of the prison's privset for the given privilege. As I was writing this, I identified the first problem with it: it doesn't currently respond to ALLOW_* updates and grant the appropriate privileges after initialization time -- this is a pretty easy fix, and I will do so if anyone else finds this useful. The other caveat is that I have no idea if there's a useful way to expose this to jail(8) users, but they're not really the primary target for this -- the primary target is system application developers that want more fine control over what a jail they're creating can do. This is an excellent foot-gun, but with great power comes great responsibility. Thanks, Kyle Evans [1] https://people.freebsd.org/~kevans/privset.diff