Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757873AbbBEPXc (ORCPT ); Thu, 5 Feb 2015 10:23:32 -0500 Received: from h2.hallyn.com ([78.46.35.8]:52377 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753646AbbBEPX3 (ORCPT ); Thu, 5 Feb 2015 10:23:29 -0500 Date: Thu, 5 Feb 2015 16:23:27 +0100 From: "Serge E. Hallyn" To: "Serge E. Hallyn" Cc: "Andrew G. Morgan" , Christoph Lameter , casey@schaufler-ca.com, Andy Lutomirski , Jonathan Corbet , Aaron Jones , "Ted Ts'o" , linux-security-module@vger.kernel.org, lkml , akpm@linuxfoundation.org, linux-api@vger.kernel.org Subject: Re: [capabilities] Allow normal inheritance for a configurable set of capabilities Message-ID: <20150205152327.GA31086@mail.hallyn.com> References: <20150202171257.GD24351@ubuntumail> <20150203155544.GE2923@mail.hallyn.com> <20150203172653.GB4748@mail.hallyn.com> <20150205003434.GC23013@mail.hallyn.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150205003434.GC23013@mail.hallyn.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2310 Lines: 52 Quoting Serge E. Hallyn (serge@hallyn.com): > Quoting Andrew G. Morgan (morgan@kernel.org): > > I'm not generally in favor of this. Mostly because this seems to be a > > mini-root kind of inheritance that propagates privilege to binaries > > that aren't prepared for privilege. > > Earlier in this thread, Casey said: > > | One of the holes in the 1003.1e spec is what to do with a program file > | that does not have a capability set attached to it. The two options are > | drop all capabilities and leave the capabilities alone. The latter gives > | you what you're asking for. The former is arguably safer. > > and > > | It's what we did in Trusted Irix. It made life much easier. > > I'm going to need to clear my head a bit before I try to compare that to > the root cause of the sendmail capabilities bug. > > > I don't really buy the mmap code > > concern because the model as it stands says that you trust the binary > > (and all of the various ways it was programmed to execute code) with > > specific privileges. If the binary mmap's some code (PAM modules come > > to mind) then that is part of what it was programmed to/allowed to do. > > That's not really the point... The point is that yes, a mini-root is > exactly what is being asked for :) I'm not saying I expect an adversary > to do the mmap+jump, but that currently it is a, and the only, way to > do unprivileged userid with retaining some privileges to run legacy > programs. > > > That being said, if you really really want this kind of thing, then > > make it a single secure bit (with another lock on/off bit) which, when > > set, makes: fI default to X. > > > > pP' = (X & fP) | (pI & fI) > > > > That way the per-process bounding set still works as advertised and > > you don't need to worry about the existing semantics being violated. > > Maybe that is the way to go... We could require nnp to set the new securebit, and add a CONFIG_SECURITY_LULZ_I_DONT_CARE to skip that requirement. (Or maybe that just makes things worse by having more different sets of rules...) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/