Date: Tue, 29 Aug 2023 15:36:06 -0400 From: Shawn Webb <shawn.webb@hardenedbsd.org> To: current@freebsd.org Subject: Re: Possible issue with linux xattr support? Message-ID: <20230829193606.ub4sqqpsyah47brg@mutt-hbsd> In-Reply-To: <tkut7qfcobxty7jrcxqlbzgl75q7hclugqu4g332c2m6lv7s6w@mlzazyhlhzff> References: <EA27BAE1-C687-47F9-BB6D-B72A85A5CA8D@cschubert.com> <elx6cvceobzgw66fskkfhhicsdpsur5xaktluu5tk7m7p4qwno@s7qmm4kyuvag> <ZOzD9noXVrslppot@heemeyer.club> <smfbmu35sxh2f3hu5nrpdwb355trlucd2bbp4ag5ke7v3zf3il@s3ua2x4i3nzj> <ZO4En1UJqcr4GGiw@heemeyer.club> <20230829190258.uc67572553e4fq3v@mutt-hbsd> <af11b09e-7b93-7c17-a8b8-6cea86291176@FreeBSD.org> <izo5sjuirgprs6dwcski2xtqqa3fqnjh47jpwrb5v4q4sqmark@3vybbvcdap4z> <20230829192516.jb2t65sp5rdlysss@mutt-hbsd> <tkut7qfcobxty7jrcxqlbzgl75q7hclugqu4g332c2m6lv7s6w@mlzazyhlhzff>
next in thread | previous in thread | raw e-mail | index | archive | help
--n7spl4be23jygaoi Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Aug 29, 2023 at 09:31:46PM +0200, Felix Palmen wrote: > * Shawn Webb <shawn.webb@hardenedbsd.org> [20230829 15:25]: > > On Tue, Aug 29, 2023 at 09:15:03PM +0200, Felix Palmen wrote: > > > * Kyle Evans <kevans@FreeBSD.org> [20230829 14:07]: > > > > On 8/29/23 14:02, Shawn Webb wrote: > > > > > Back in 2019, I had a similar issue: I needed access to be able to > > > > > read/write to the system extended attribute namespace from within= a > > > > > jailed context. I wrote a rather simple patch that provides that > > > > > support on a per-jail basis: > > > > >=20 > > > > > https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/commit/96c8= 5982b45e44a6105664c7068a92d0a61da2a3 > > > > >=20 > > > > > Hopefully that's useful to someone. > > > > >=20 > > > > > Thanks, > > > > >=20 > > > >=20 > > > > FWIW (which likely isn't much), I like this approach much better; i= t makes > > > > more sense to me that it's a feature controlled by the creator of t= he jail > > > > and not one allowed just by using a compat ABI within a jail. > > >=20 > > > Well, a typical GNU userland won't work in a jail without this, that's > > > what I know now. But I'm certainly with you, it doesn't feel logical > > > that a Linux binary can do something in a jail a FreeBSD binary can't. > > >=20 > > > So, indeed, making it a jail option sounds better. > > >=20 > > > Unless, bringing back a question raised earlier in this thread: What's > > > the reason to restrict this in a jailed context in the first place? I= OW, > > > could it just be allowed unconditionally? > >=20 > > In HardenedBSD's case, since we use filesystem extended attributes to > > toggle exploit mitigations on a per-application basis, there's now a > > conceptual security boundary between the host and the jail. > >=20 > > Should the jail and the host share resources, like executables, a > > jailed process could toggle an exploit mitigation, and the toggle > > would bubble up to the host. So the next time the host executed > > /shared/app/executable/here, the security posture of the host would be > > affected. >=20 > Isn't the sane approach here *not* to share any executables with a jail > other than via a read-only nullfs mount? I thought about that, too, but nullfs is not guaranteed to be available or applicable in all environments. Thanks, --=20 Shawn Webb Cofounder / Security Engineer HardenedBSD https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A= 4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc --n7spl4be23jygaoi Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEA6TL67gupaZ9nzhT/y5nonf44foFAmTuSKAACgkQ/y5nonf4 4fqOMxAAmCBZusX2my38z9cqfCanWLPWFhOG8ocXB6zUGNr5wgv4orQk8SqxwQdU IDwhsMQTxYY12yCYlpfKIM2HXyjB78Fmp2lLJAnszczsnECb9k1Q9OHV1QylwsQ9 7D/T2FBODIY8LdmS79x4jzNGAsEyd1BJpHMgjSFxK0a80McpWV7XJd6nXxPdSnqF ZM/x/WTCcxzsis5SuOeSswZwmpADDLC8RbiVFrSWR7ZOxdAzQbr58As+uzptpI5z A/OdGX1LNppial8KMJii9kxkvj+mZfdamIXfk1KNisZJAGzfb1IyAX9BIWhLSId5 aHZfNU2m2OYLcqOg30rIARvTRFMPhlp8RXZZoxJjglpmpH8Eq10/b5Z9nO8DER2Q H08Gb9bkdfzCqpXOKPY5+MP9OBFYxUIZFc2wp0qyquEEoZc+3rbaKK0A/5w2rjTa AoygED6oL2kKifMG98+sPduFFw29sDEE/4D2HaRKBJlTcftG0+ByPu/UOFSxpBxC 88UCX6p3LyLUT/gwXMXI0nrlEAqXFzxBdUkrUi+e6v5cMaH6PVVhVHkv9Xsz2g0p EzY+6OmSWX/BP66gsGj9MUb9rmOHc2m3ZurP0sKdiQ8c0jcF/+e7n4Kw3b1SLvYk 6AIFaBw3yirarAeo7hsWGC4jvwUZiwlJAEvnxZDcc+eSOsdFkZI= =J0gA -----END PGP SIGNATURE----- --n7spl4be23jygaoi--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20230829193606.ub4sqqpsyah47brg>