Date: Thu, 5 Nov 2015 11:34:38 -0600
From: "Serge E. Hallyn" <serge@hallyn.com>
To: Klaus Ethgen <Klaus+lkml@ethgen.de>
Cc: "Serge E. Hallyn" <serge@hallyn.com>,
        Andy Lutomirski <luto@amacapital.net>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Richard Weinberger <richard.weinberger@gmail.com>,
        LKML <linux-kernel@vger.kernel.org>, Christoph Lameter <cl@linux.com>,
        Andy Lutomirski <luto@kernel.org>,
        Serge Hallyn <serge.hallyn@ubuntu.com>,
        Kees Cook <keescook@chromium.org>,
        Andrew Morton <akpm@linux-foundation.org>
Subject: Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks
 security in systems  using capabilities
Message-ID: <20151105173438.GA3378@mail.hallyn.com>
References: <CA+55aFw84QZ-E3KeH+93ZGofo6u-dq3bp72KwF3h2q63wYydCQ@mail.gmail.com>
 <CALCETrUaCntyegj7JPqo4V5Rbx1WXKw9PQ7dizUQhbNvnbcOBQ@mail.gmail.com>
 <20151102191616.GA2158@ikki.ethgen.ch>
 <CALCETrXFPbKSU6x2f4BjdFeUoKnCKjOUs=PUMkYwck-nX4zyvw@mail.gmail.com>
 <20151105101953.GA15293@ikki.ethgen.ch>
 <20151105161512.GA2180@mail.hallyn.com>
 <20151105171701.GB9307@ikki.ethgen.ch>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20151105171701.GB9307@ikki.ethgen.ch>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1050
Lines: 21

On Thu, Nov 05, 2015 at 06:17:01PM +0100, Klaus Ethgen wrote:
> Hi Serge,
> 
> Am Do den  5. Nov 2015 um 17:15 schrieb Serge E. Hallyn:
> > I think if you follow your idea to its logical conclusions, you end
> > up wanting set SECURE_ALL_BITS | SECURE_ALL_LOCKS, which will include
> > SECURE_NO_CAP_AMBIENT_RAISE, disabling ambient capabilities.
> 
> That I did miss out and seems to be the solution for the problem. So
> adding cap_secure_all_bits,cap_secure_all_locks=ep to every binary that
> gets other caps should solve it?

No that doesn't work, you have to use prctl to set those bits.  If you
can get your system to be fully rootless, you can have init or initramfs
do this for you.  It'll mean that root and setuid-root binaries have no
automatic privileges beside owning host (proc/sys) files.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/