Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1161866AbbKFR43 (ORCPT ); Fri, 6 Nov 2015 12:56:29 -0500 Received: from tschil.ethgen.ch ([5.9.7.51]:55344 "EHLO tschil.ethgen.ch" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1161008AbbKFR41 (ORCPT ); Fri, 6 Nov 2015 12:56:27 -0500 Date: Fri, 6 Nov 2015 18:56:20 +0100 From: Klaus Ethgen To: "Theodore Ts'o" , "Serge E. Hallyn" , Andy Lutomirski , Linus Torvalds , Richard Weinberger , LKML , Christoph Lameter , Andy Lutomirski , Serge Hallyn , Kees Cook , Andrew Morton Subject: Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities Message-ID: <20151106175619.GA19491@ikki.ethgen.ch> References: <20151105101953.GA15293@ikki.ethgen.ch> <20151105161512.GA2180@mail.hallyn.com> <20151105171701.GB9307@ikki.ethgen.ch> <20151105173438.GA3378@mail.hallyn.com> <20151105174823.GD9307@ikki.ethgen.ch> <20151105220843.GA6027@mail.hallyn.com> <20151106135835.GB11901@ikki.ethgen.ch> <20151106155303.GB6160@thunk.org> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1; x-action=pgp-signed In-Reply-To: <20151106155303.GB6160@thunk.org> OpenPGP: id=79D0B06F4E20AF1C; url=http://www.ethgen.ch/~klaus/79D0B06F4E20AF1C.txt; preference=signencrypt User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3324 Lines: 72 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Am Fr den 6. Nov 2015 um 16:53 schrieb Theodore Ts'o: > On Fri, Nov 06, 2015 at 02:58:36PM +0100, Klaus Ethgen wrote: > > But that left out completely the, I think more important, usecase of > > _removing_ SUID completely and _replacing_ it with very tight capability > > setting. And that is what I always talked about. > > I don't believe this is ever going to be possible. And I'm not > talking about it from a technical perspective, but from a practical > and cultural perspective. > > The problem with removing SUID and inheritance completely is that you > have to anticipate all possible use cases where a system administrator > might want to use a root shell. This means analyzing all possible use > cases for all possible system administrators how they might need to > use a root shell to fix or management a system, That is not my interest at all. I wan't to get rid of all the SUID _binaries_ that are used by _normal_ users. (And me counting as normal user in the most time too.) I do not want to remove root or something like that. For that task, capabilities is definitively the wrong tool. > and then either (a) > provide a new, specialized tool that solves that particular use case, > while respecting the rules of least privilege, or (b) figure out how > to expand that executable's fI mask, and worse, if that executable > fork and exec's helper programs, those helper programs will need to > have expanded fI masks. And that's if all of the commands that a > system administrator needs to run are compiled executables. Now > consider what happens when a system administrator needs to run python, > perl, or shell scripts with elevated privileges. Independent of, that I do not want to address this, I never want to have a shell (sh, perl, python, ruby, ...) in such a construct. > In the light of that, using things like ambient capabilities, or using > setuid binary that immediately drops all caps that it needs, is > probably the best we're going to get. I do never want that! Even to think about such a way to give any shell raised rights is horrible! And that horrible idea is it that makes all the ambient capabilities that bad. Regards Klaus - -- Klaus Ethgen http://www.ethgen.ch/ pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQGcBAEBCgAGBQJWPOm+AAoJEKZ8CrGAGfaseE0L+gKhc7DLjkcfVMtYQHFpxTTt C/12GrwxUl+rumO+FPlFhuRBFwFFpLk4BNul6M7MeIJcV8DjDGDTWeRV30/0+gpA qzxpC5lHeNxdgpvom9/wcHEDHXSmZ134zDRcbHVvfn9VGOSi/aZcBvK3Cl5UJPsI vOXbiVeFFRYISEWyoAt9FV/w8z4xFdd6yFZHlZ33mX/FaUNk2Rtdlpwe+lPq6CgO f1mrC4AANY2Hl0sAtoeBhHcscE6lUIujs1katxCwdG5BHSVjaWbvbnLtyKgC6XoN ttoq+jTCsUVo0k3Aae4s6zgfPt3LfrT8ymwlNRNgimD1jq10yM8hsPPXTr9yqvhj VNp+OqozuGvqLoMQApvR3mV0AujBruLmC8g7xMrpmubrQzp+96rUXj82YYtCC9/l ++zTsz5Ik8G/rW/AevDWow0HilaNnqMZeNXevjKNiUK/jGhL1S+4I0bh+PbKrjqc bqC/WDhcimkle5sGH9q6NeQBAsC7mRTsgKOULCVnEw== =9dzb -----END PGP SIGNATURE----- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/