[PATCH 0/2] userns: keep the exec securebits

[Christian Brauner]

The exec securebits are meant to be set and locked by a service manager
so that nothing below it can turn them off again. But creating a user
namespace resets all securebits, locks included. So anyone who may
create a user namespace can shed them with a single
unshare(CLONE_NEWUSER), and joining one with setns() does the same.
That's pretty much everyone.

systemd gains a SecureBits= setting for the service manager itself. It
sets and locks the exec bits for everything it starts, so interpreters
that support AT_EXECVE_CHECK enforce the system's execution policy for
their scripts. With the reset "unshare -U python3 /tmp/x.py" gets
around all of that.

The other securebits are about how capabilities are computed and
resetting them in a new user namespace is fine. The exec bits grant
nothing. They're restrictions a task placed on itself, like
no_new_privs, which a user namespace doesn't drop either. So keep them
and their locks and keep resetting the rest.

I also keep the exec bits that aren't locked. fork() and execve()
preserve them and the task can clear them itself anyway, so dropping
them on unshare() would just be inconsistent.

The new selftests fail on mainline and pass with the fix. I think this
wants to go to stable, otherwise the locks don't mean much on any kernel
that has these bits.

Signed-off-by: Christian Brauner (Amutable) <brauner@xxxxxxxxxx>
---
Christian Brauner (2):
      userns: don't drop the exec securebits
      selftests/exec: check that user namespaces keep the exec securebits

 Documentation/userspace-api/check_exec.rst |  4 ++
 kernel/user_namespace.c                    |  5 +-
 tools/testing/selftests/exec/check-exec.c  | 83 ++++++++++++++++++++++++++++++
 3 files changed, 91 insertions(+), 1 deletion(-)
---
base-commit: 21a7f44fd0765fcc5194130b28767786eba1d1e7
change-id: 20261026-work-securebits-userns-6070b18a9cda