Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753943AbbGIS1O (ORCPT ); Thu, 9 Jul 2015 14:27:14 -0400 Received: from emvm-gh1-uea09.nsa.gov ([63.239.67.10]:51379 "EHLO emvm-gh1-uea09.nsa.gov" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753608AbbGIS1I (ORCPT ); Thu, 9 Jul 2015 14:27:08 -0400 X-TM-IMSS-Message-ID: <60da07d9000bfe3a@nsa.gov> Message-ID: <559EBCC0.7040604@tycho.nsa.gov> Date: Thu, 09 Jul 2015 14:26:08 -0400 From: Stephen Smalley Organization: National Security Agency User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: Greg KH , Daniel Mack , Djalal Harouni , lkml , LSM , Paul Osmialowski , Casey Schaufler , Paul Moore Subject: kdbus: credential faking Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1584 Lines: 31 Hi, I have a concern with the support for faked credentials in kdbus, but don't know enough about the original motivation or intended use case to evaluate it concretely. I raised this issue during the "kdbus for 4.1-rc1" thread a while back but none of the kdbus maintainers responded, and the one D-BUS maintainer who did respond said that there is no API in dbus-daemon for faking client credentials, so this is not something inherited from dbus-daemon or required for compatibility with it. First, I have doubts as to whether there should be any way to fake the seclabel, no matter how "privileged" the caller. Unless there is a clear use case for that functionality, I would prefer to see it dropped altogether. Second, IIUC, the ability to fake any portion of the credentials or pids is granted if the caller either has CAP_IPC_OWNER or owns the bus (uid match). Clearly that isn't sufficient basis for seclabel faking, and it seems questionable as to whether it should be sufficient for faking any of the other credentials or pids. Compare with e.g. net/core/scm.c:scm_check_creds() logic for faking credentials on a Unix domain socket, which requires CAP_SYS_ADMIN for faking pid, CAP_SETUID for faking any of the uid fields, and CAP_SETGID for faking any of the gid fields. Thanks for any light you can shed on the matter. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/