{"action":"created","issue":{"url":"https://api.github.com/repos/projectatomic/bubblewrap/issues/101","repository_url":"https://api.github.com/repos/projectatomic/bubblewrap","labels_url":"https://api.github.com/repos/projectatomic/bubblewrap/issues/101/labels{/name}","comments_url":"https://api.github.com/repos/projectatomic/bubblewrap/issues/101/comments","events_url":"https://api.github.com/repos/projectatomic/bubblewrap/issues/101/events","html_url":"https://github.com/projectatomic/bubblewrap/pull/101","id":178920186,"number":101,"title":"bwrap: capabilities support","user":{"login":"giuseppe","id":67430,"avatar_url":"https://avatars.githubusercontent.com/u/67430?v=3","gravatar_id":"","url":"https://api.github.com/users/giuseppe","html_url":"https://github.com/giuseppe","followers_url":"https://api.github.com/users/giuseppe/followers","following_url":"https://api.github.com/users/giuseppe/following{/other_user}","gists_url":"https://api.github.com/users/giuseppe/gists{/gist_id}","starred_url":"https://api.github.com/users/giuseppe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/giuseppe/subscriptions","organizations_url":"https://api.github.com/users/giuseppe/orgs","repos_url":"https://api.github.com/users/giuseppe/repos","events_url":"https://api.github.com/users/giuseppe/events{/privacy}","received_events_url":"https://api.github.com/users/giuseppe/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2016-09-23T16:30:17Z","updated_at":"2016-10-26T15:35:40Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/projectatomic/bubblewrap/pulls/101","html_url":"https://github.com/projectatomic/bubblewrap/pull/101","diff_url":"https://github.com/projectatomic/bubblewrap/pull/101.diff","patch_url":"https://github.com/projectatomic/bubblewrap/pull/101.patch"},"body":"a few patches that modify how bubblewrap works in privileged mode to allow execution of systemd:\r\n\r\nhttps://asciinema.org/a/7gex3vdcumd1n72i3knstra2b\r\n"},"comment":{"url":"https://api.github.com/repos/projectatomic/bubblewrap/issues/comments/256384969","html_url":"https://github.com/projectatomic/bubblewrap/pull/101#issuecomment-256384969","issue_url":"https://api.github.com/repos/projectatomic/bubblewrap/issues/101","id":256384969,"user":{"login":"alexlarsson","id":990736,"avatar_url":"https://avatars.githubusercontent.com/u/990736?v=3","gravatar_id":"","url":"https://api.github.com/users/alexlarsson","html_url":"https://github.com/alexlarsson","followers_url":"https://api.github.com/users/alexlarsson/followers","following_url":"https://api.github.com/users/alexlarsson/following{/other_user}","gists_url":"https://api.github.com/users/alexlarsson/gists{/gist_id}","starred_url":"https://api.github.com/users/alexlarsson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexlarsson/subscriptions","organizations_url":"https://api.github.com/users/alexlarsson/orgs","repos_url":"https://api.github.com/users/alexlarsson/repos","events_url":"https://api.github.com/users/alexlarsson/events{/privacy}","received_events_url":"https://api.github.com/users/alexlarsson/received_events","type":"User","site_admin":false},"created_at":"2016-10-26T15:35:40Z","updated_at":"2016-10-26T15:35:40Z","body":"There is still a fundamental question about what bubblewrap provides here that we need to figure out. Lots of distros (including rhel7) disable user namespaces or make it only accessible by root, because the attack surface for user namespaces is so large (see e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3135). \r\n\r\nThe story so far is that we expose only a subset of the user namespace operations, which we deem safe (mainly bind mounts, etc), so it is safe to allow this setuid binary to run for everyone, even though everyone is not allowed use of user namespace.\r\n\r\nHowever, due to the ptrace issue we're *not* really any more secure than a general user namespace, because bwrap can be attacked via ptrace to allow arbitrary code execution in the privileged-in-user-ns part of the setup, and bwrap could thus be used to attack e.g. the CVE above. This means that a setuid bwrap is essentially neutering the distro decision to limit user namespaces to root, which I think is a bad idea.\r\n\r\nSo, the question here is if we can use user namespaces at all..."}}
{"actor":{"display_login":"alexlarsson"}}