Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752137AbbKFSSZ (ORCPT ); Fri, 6 Nov 2015 13:18:25 -0500 Received: from h2.hallyn.com ([78.46.35.8]:57177 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750784AbbKFSSY (ORCPT ); Fri, 6 Nov 2015 13:18:24 -0500 Date: Fri, 6 Nov 2015 12:18:20 -0600 From: "Serge E. Hallyn" To: Klaus Ethgen Cc: "Theodore Ts'o" , "Serge E. Hallyn" , Andy Lutomirski , Linus Torvalds , Richard Weinberger , LKML , Christoph Lameter , Andy Lutomirski , Serge Hallyn , Kees Cook , Andrew Morton Subject: Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities Message-ID: <20151106181820.GB16749@mail.hallyn.com> References: <20151105101953.GA15293@ikki.ethgen.ch> <20151105161512.GA2180@mail.hallyn.com> <20151105171701.GB9307@ikki.ethgen.ch> <20151105173438.GA3378@mail.hallyn.com> <20151105174823.GD9307@ikki.ethgen.ch> <20151105220843.GA6027@mail.hallyn.com> <20151106135835.GB11901@ikki.ethgen.ch> <20151106155303.GB6160@thunk.org> <20151106175619.GA19491@ikki.ethgen.ch> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20151106175619.GA19491@ikki.ethgen.ch> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1772 Lines: 34 On Fri, Nov 06, 2015 at 06:56:20PM +0100, Klaus Ethgen wrote: > Am Fr den 6. Nov 2015 um 16:53 schrieb Theodore Ts'o: > > In the light of that, using things like ambient capabilities, or using > > setuid binary that immediately drops all caps that it needs, is > > probably the best we're going to get. > > I do never want that! Even to think about such a way to give any shell > raised rights is horrible! And that horrible idea is it that makes all > the ambient capabilities that bad. I sympathize with your point of view, but Christoph's use case really was a good one. A piece of system configuration software needs to do some networking setup with some privilege, including calling scripts. It can either do so as root or not at all - polluting every program that will end up getting called with fI is not only ugly but simply doesn't work (because scripts). Saying that the whole thing must be written as self-contained executable that never needs to be re-execed is frequently unrealistic. So this allows a piece of software to run with reduce privilege, and it is an improvement over the previous state of affairs. It is not intended for login shells. I would have been happy if there had been a default-off PR_ENABLE_AMBIENT prctl which required a new CAP_ENABLE_AMBIENT capability to turn on, but the current set of rules which removes bits from pA whenever doing an action which capability-aware software does something which it would have reasonably expected to drop privilege is a nice safeguard. -serge -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/