Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933655AbbBDV5i (ORCPT ); Wed, 4 Feb 2015 16:57:38 -0500 Received: from resqmta-ch2-01v.sys.comcast.net ([69.252.207.33]:55474 "EHLO resqmta-ch2-01v.sys.comcast.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932669AbbBDV5e (ORCPT ); Wed, 4 Feb 2015 16:57:34 -0500 Date: Wed, 4 Feb 2015 15:57:33 -0600 (CST) From: Christoph Lameter X-X-Sender: cl@gentwo.org To: Andy Lutomirski cc: "Serge E. Hallyn" , "Andrew G. Morgan" , Serge Hallyn , Serge Hallyn , Jonathan Corbet , Aaron Jones , "Ted Ts'o" , LSM List , lkml , Andrew Morton Subject: Re: [RFC] Implement ambient capability set. In-Reply-To: Message-ID: References: <20150204211617.GA20787@mail.hallyn.com> Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 933 Lines: 21 On Wed, 4 Feb 2015, Andy Lutomirski wrote: > But someone will want to run *bash* as an untrusted user with, say, > CAP_NET_BIND permitted and ambient. Then that user has a non-empty > ambient set, and they can run a setuid-root program, and who knows > what will go wrong? Requiring no_new_privs would prevent this type of > failure entirely. > > If we need to relax that later, it's easy, I think. The rule's not > that convoluted, and there's precedent for having new fancy features > require setting no_new_privs first. It would make the patch pointless. The case of having to run a setuid root prpgrams from a shell that has the caps enabled is a routine thing for testing etc. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/