Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753079AbbBWQQj (ORCPT ); Mon, 23 Feb 2015 11:16:39 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:34377 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752879AbbBWQQe (ORCPT ); Mon, 23 Feb 2015 11:16:34 -0500 Date: Mon, 23 Feb 2015 16:16:25 +0000 From: Serge Hallyn To: Christoph Lameter Cc: Serge Hallyn , Andy Lutomirski , Aaron Jones , "Ted Ts'o" , linux-security-module@vger.kernel.org, akpm@linuxfoundation.org, "Andrew G. Morgan" , Mimi Zohar , Austin S Hemmelgarn , Markku Savela , Jarkko Sakkinen , linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, Michael Kerrisk , Jonathan Corbet Subject: Re: [PATCH] capabilities: Ambient capability set V1 Message-ID: <20150223161625.GD25477@ubuntumail> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1470 Lines: 34 Quoting Christoph Lameter (cl@linux.com): > Ok 4.0-rc1 is out and this patch has been sitting here for a couple of > weeks without comment after an intensive discussion about the RFCs. > > Since there were no objections: Is there any chance to get this into -next > somehow? Andrew Morgan and Andy Lutomirski appear to have a similar concern but competing ideas on how to address them. We need them to agree on an approach. The core concern for amorgan is that an unprivileged user not be able to cause a privileged program to run in a way that it fails to drop privilege before running unprivileged-user-provided code. Andy Lutomirski's concern is simply that code which is currently doing the right thing to drop privilege not be run in a way that it thinks it is dropping privilege, but in fact is not. (Please correct me where I've mis-spoken or misunderstood) Since your desire is precisely for a mode where dropping privilege works as usual, but exec then re-gains some or all of that privilege, we need to either agree on a way to enter that mode that ordinary use caes can't be tricked into using, or find a way for legacy users to be tpiped off as to what's going on (without having to be re-written) -serge -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/