Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753747AbbG1PGk (ORCPT ); Tue, 28 Jul 2015 11:06:40 -0400 Received: from h2.hallyn.com ([78.46.35.8]:44400 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752212AbbG1PGi (ORCPT ); Tue, 28 Jul 2015 11:06:38 -0400 Date: Tue, 28 Jul 2015 10:06:36 -0500 From: "Serge E. Hallyn" To: Casey Schaufler Cc: Sungbae Yoo , "'Lukasz Pawelczyk'" , "'James Morris'" , "'Serge E. Hallyn'" , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] Smack: replace capable() with ns_capable() Message-ID: <20150728150636.GA1656@mail.hallyn.com> References: <1437737174-29451-1-git-send-email-sungbae.yoo@samsung.com> <1437738032.2190.2.camel@samsung.com> <000001d0c80b$55bdec50$0139c4f0$@samsung.com> <55B7936E.2080007@schaufler-ca.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <55B7936E.2080007@schaufler-ca.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1065 Lines: 23 On Tue, Jul 28, 2015 at 07:36:30AM -0700, Casey Schaufler wrote: > On 7/26/2015 6:27 PM, Sungbae Yoo wrote: > > So, Do you agree to allow the process to change its own labels? > > No. This requires CAP_MAC_ADMIN. Smack is mandatory access control. > Being in a namespace (as they are implemented today) is not sufficient. "requires CAP_MAC_ADMIN" should probably read "requires CAP_MAC_ADMIN against initial user namespace." Any unprivileged user can unshare a user_ns and get CAP_MAC_ADMIN. I'm terribly sorry I'm not yet caught up on the smack-lsm thread. But intuitively I'd think that you'd want a way for smack policy to say "this label is allowed to create a user-ns which will be allowed to CAP_MAC_ADMIN", so then smack_capable() can use that information to cleanly deny CAP_MAC_ADMIN in namespaces. -serge -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/