Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966093AbbBCPwr (ORCPT ); Tue, 3 Feb 2015 10:52:47 -0500 Received: from h2.hallyn.com ([78.46.35.8]:42172 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966011AbbBCPwp (ORCPT ); Tue, 3 Feb 2015 10:52:45 -0500 X-Greylist: delayed 353 seconds by postgrey-1.27 at vger.kernel.org; Tue, 03 Feb 2015 10:52:45 EST Date: Tue, 3 Feb 2015 16:46:51 +0100 From: "Serge E. Hallyn" To: Andy Lutomirski Cc: Serge Hallyn , Casey Schaufler , Christoph Lameter , Serge Hallyn , Jonathan Corbet , Aaron Jones , "Ted Ts'o" , LSM List , "linux-kernel@vger.kernel.org" , Andrew Morton Subject: Re: [capabilities] Allow normal inheritance for a configurable set of capabilities Message-ID: <20150203154651.GC2923@mail.hallyn.com> References: <54CFB9B8.8020701@schaufler-ca.com> <20150202180806.GE24351@ubuntumail> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1973 Lines: 35 Quoting Andy Lutomirski (luto@amacapital.net): > On Mon, Feb 2, 2015 at 10:08 AM, Serge Hallyn wrote: > > Quoting Casey Schaufler (casey@schaufler-ca.com): > >> I'm game to participate in such an effort. The POSIX scheme > >> is workable, but given that it's 20 years old and hasn't > >> developed real traction it's hard to call it successful. > > > > Over the years we've several times discussed possible reasons for this > > and how to help. I personally think it's two things: 1. lack of > > toolchain and fs support. The fact that we cannot to this day enable > > ping using capabilities by default because of cpio, tar and non-xattr > > filesystems is disheartening. 2. It's hard for users and applications > > to know what caps they need. yes the API is a bear to use, but we can > > hide that behind fancier libraries. But using capabilities requires too > > much in-depth knowledge of precisely what caps you might need for > > whatever operations library may now do when you asked for something. > > None of this could address the problem here, though: if I hold a > capability and I want to pass that capability to an exec'd helper, I > shouldn't need the fs's help to do this. Yes you should. It's not about needing the fs's help, it's about the binary on the exec being imbued with some part of the privilege. In TE paralance it would be an entry point to the privilege. I'm not saying "that's how it should be", just "that's how posix caps work". So again I think the pA seems like an elegant way to work around this. I'm interested in other ideas, but I worry about the proc solution Christoph proposed because it would be system- or namespace-wide, rather than per-process. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/