Re: [GIT PULL] LSM patches for v6.1

[Theodore Ts'o]

Eric, there's one thing I don't get about why you hate LSM's having
the ability to prevent user name spaces, and yet you are OK with
(indeed, touting) /proc/sys/user/max_user_namespaces.

If we set max_user_namespaces to N, won't the N+1'th application get
an error when they try to create a user namespace?  One of your
arguments about why having LSM's forcing a error of say, EPERM, is
that applications that don't check for error returns might get
confused.  (Those are buggy applications; so they should be fixed ---
isn't that your argument about why we shouldn't be freaking out over
security bugs caused by kernel bugs and user namespaces.)  But if you
set max_user_namespaces, that same application will now fail with say,
ENOSPC.

And if in fact there is a buggy application that will create a
security exposure because they aren't checking !@#@?! error returns,
an attacker can simply create N user namespaces --- and then trigger
the buggy applicaion, at which point, they will have 0wned the system.

    	  	      	       	      - Ted