Security - Revision history

Xemul at 09:28, 14 December 2016

2016-12-14T09:28:05Z

Xemul at 19:22, 10 December 2015

2015-12-10T19:22:17Z

Cyrillos: not needed anymore

2015-09-14T16:41:58Z

not needed anymore

Cyrillos: Some datails about global CAPs we need in criu

2015-09-14T13:50:27Z

Some datails about global CAPs we need in criu

Xemul at 19:50, 10 March 2015

2015-03-10T19:50:51Z

Efiop: Mention new security policy

2014-08-06T12:29:47Z

Mention new security policy

New page

Due to restrictions imposed by several kernel APIs CRIU uses, the tools can only work with run with root privileges. However, if the node administrator sets the +suid bit on the criu binary, or runs criu as an [[RPC]] service, criu will be able to work on behalf of regular user.

In the latter case, the following security restrictions would apply:
<pre>
Legend:
cr_* -- ids of the calling user;
others -- ids of process that we're trying to dump/restore;
</pre>
* criu will refuse to '''dump/restore''' process if [se]?uid is not equal to cr_uid
* criu will refuse to '''dump/restore''' process if [se]?gid is not equal to cr_gid or cr_groups do not contain it
* criu will refuse to '''restore''' process if cr_groups don't contain groups
* criu will refuse to '''dump/restore''' any bits set in any capability set

== Code example ==
Here is a simplified version of code from security.c.

<source lang="c" style="font-size: 120%;">
bool check_uids()
{
if (cr_uid == 0)
return true;

if (cr_uid == ruid && cr_uid == suid && cr_uid == eid)
return true;

return false;
}

bool check_gids()
{
if (cr_gid == 0)
return true;

if ((contains(cr_groups, rgid) || cr_gid == rgid) &&
(contains(cr_groups, egid) || cr_gid == egid) &&
(contains(cr_groups, sgid) || cr_gid == sgid))
return true;

return false;
}

/*
* There is no need to check groups on dump, because if uids and gids match
* then groups will match too. Btw, getting groups on dump is problematic.
* We can't parse proc, as it contains only first 32 groups. And we can't use
* getgrouplist, as it reads /etc/group which depends on the namespace.
*
* On restore we're getting groups from imgs and can check if user didn't add
* wrong groups by modifying images.
*/
bool check_groups()
{
if (cr_gid == 0)
return true;

for (i = 0; i < ngroups; ++i) {
if (!contains(cr_groups, groups[i]))
return false;
}

return true;
}

bool check_caps()
{
/*
* Impose the most strict requirements for now.
* "Real" root user can use any caps, other users may
* use none. Later we will implement more sophisticated
* security model.
*/

if (cr_uid == 0 && cr_gid == 0)
return true;

for (i = 0; i < CR_CAP_SIZE; i++) {
if (inh[i] != 0 || eff[i] != 0 || prm[i] != 0)
return false;
}

return true;
}

bool may_dump()
{
return check_uids() &&
check_gids() &&
check_caps();
}

bool may_restore()
{
return check_uids() &&
check_gids() &&
check_groups() &&
check_caps();
}
</source>

@@ Line 1: / Line 1: @@
 Due to restrictions imposed by several kernel APIs CRIU uses, the tools can only work with run with root privileges. The plan is to provide [[user-mode]], but it will have restrictions.
-In the latter case, the following security restrictions would apply:
+== Service mode ==
-<pre>
-Legend:
+If CRIU is run as [[CLI/cmd/service|service]] from root, make sure the connection socket is restricted to unauthorized access. The service doesn't make any additional checks about the RPC caller, it just goes and performs the requested action.
 == See also ==
@@ Line 16: / Line 9: @@
 CRIU has security issues when working with [[Userns|user namespaces]] and [[selinux]]
 [[Category: API]]

← Older revision		Revision as of 19:22, 10 December 2015
Line 1:		Line 1:
−	Due to restrictions imposed by several kernel APIs CRIU uses, the tools can only work with run with root privileges. ~~However, if the node administrator sets the +suid bit on the criu binary, or runs criu as an~~ [[~~RPC~~]] ~~service~~, ~~criu~~ will ~~be able to work on behalf of regular user~~.	+	Due to restrictions imposed by several kernel APIs CRIU uses, the tools can only work with run with root privileges. The plan is to provide [[user-mode]], but it will have restrictions.

	In the latter case, the following security restrictions would apply:		In the latter case, the following security restrictions would apply:

← Older revision		Revision as of 16:41, 14 September 2015
Line 15:		Line 15:

	CRIU has security issues when working with [[Userns\|user namespaces]] and [[selinux]]		CRIU has security issues when working with [[Userns\|user namespaces]] and [[selinux]]
−
−	~~== Kernel restrictions ==~~
−
−	~~Currently there are a few places in the kernel which test for action preformed being allowed for capable users only:~~
−
−	* Reading of <code>/proc/$pid/map_files</code> entries is guarded by <code>CAP_SYS_ADMIN</code>. This data is intensively used by CRIU on the dump.
−	* Restoring memory maps with <code>prctl</code> may require <code>CAP_SYS_RESOURCE</code> on old CRIU versions which don't use <code>PR_SET_MM_MAP</code> interface.
−	* Upon CRIU start it might try to load net-diag modules which require <code>CAP_SYS_MODULE</code>.

	== Code example ==		== Code example ==

← Older revision		Revision as of 13:50, 14 September 2015
Line 15:		Line 15:

	CRIU has security issues when working with [[Userns\|user namespaces]] and [[selinux]]		CRIU has security issues when working with [[Userns\|user namespaces]] and [[selinux]]
		+
		+	== Kernel restrictions ==
		+
		+	Currently there are a few places in the kernel which test for action preformed being allowed for capable users only:
		+
		+	* Reading of <code>/proc/$pid/map_files</code> entries is guarded by <code>CAP_SYS_ADMIN</code>. This data is intensively used by CRIU on the dump.
		+	* Restoring memory maps with <code>prctl</code> may require <code>CAP_SYS_RESOURCE</code> on old CRIU versions which don't use <code>PR_SET_MM_MAP</code> interface.
		+	* Upon CRIU start it might try to load net-diag modules which require <code>CAP_SYS_MODULE</code>.

	== Code example ==		== Code example ==

@@ Line 12: / Line 12: @@
 * criu will refuse to '''dump/restore''' any bits set in any capability set
 == Code example ==
@@ Line 98: / Line 101: @@
+}
 </source>