Subject: Re: [RFC] [PATCH] file posix capabilities
From: Stephen Smalley <sds@tycho.nsa.gov>
To: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Nicholas Miell <nmiell@comcast.net>,
       "Eric W. Biederman" <ebiederm@xmission.com>,
       "Serge E. Hallyn" <serue@us.ibm.com>,
       lkml <linux-kernel@vger.kernel.org>,
       linux-security-module@vger.kernel.org, chrisw@sous-sol.org
In-Reply-To: <20060815114946.GA7267@vino.hallyn.com>
References: <20060730011338.GA31695@sergelap.austin.ibm.com>
	 <20060814220651.GA7726@sergelap.austin.ibm.com>
	 <m1r6zirgst.fsf@ebiederm.dsl.xmission.com>
	 <20060815020647.GB16220@sergelap.austin.ibm.com>
	 <m13bbyr80e.fsf@ebiederm.dsl.xmission.com>
	 <1155615736.2468.12.camel@entropy>  <20060815114946.GA7267@vino.hallyn.com>
Content-Type: text/plain
Organization: National Security Agency
Date: Tue, 15 Aug 2006 12:18:08 -0400
Message-Id: <1155658688.1780.33.camel@moss-spartans.epoch.ncsc.mil>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1800
Lines: 37

On Tue, 2006-08-15 at 06:49 -0500, Serge E. Hallyn wrote:
> Quoting Nicholas Miell (nmiell@comcast.net):
> > OTOH, everybody seems to have moved from capability-based security
> > models on to TE/RBAC-based security models, so maybe this isn't worth
> > the effort?
> 
> One day perhaps, but that day isn't here yet.  People are still using
> setuid (see /sbin/passwd), so obviously they're not sufficiently
> comfortable using *only* TE/RBAC.

The hard part of capabilities isn't the kernel mechanism - it is the
proper assignment and management of the capability bits on files, and
teaching userland that uid 0 is no longer magic.  Which is all work that
is already well underway for SELinux, but you would have to replicate it
for capabilities.  And since there is no notion of equivalence classes
ala SELinux types and the "policy" is completely distributed throughout
the filesystem state, management is going to be even more painful for
the capabilities.

On the kernel side, in addition to updating the bprm_secureexec logic,
you would need to consider whether the capability module needs to
implement capability comparisons for the other hooks, like task_kill.
At present, many operations only involve uid comparisons and SELinux
checks without explicitly comparing capability sets.  Properly isolating
and protecting processes with different capability sets but the same uid
is something SELinux already can do (based on domain), whereas the
existing capability module doesn't really provide that. 
 
-- 
Stephen Smalley
National Security Agency

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/