From: Casey Schaufler Subject: Re: [RFC PATCH 1/2] security, capabilities: Add CAP_SYS_MOUNT Date: Sat, 21 Oct 2017 10:31:24 -0700 Message-ID: References: <20171021134303.20685-1-nicolas@belouin.fr> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit To: Nicolas Belouin , David Howells , Theodore Ts'o , Andreas Dilger , Alexander Viro , Serge Hallyn , Paul Moore , Stephen Smalley , Eric Paris , James Morris , linux-cachefs@redhat.com, linux-kernel@vger.kernel.org, linux-ext4@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, linux-api@vger.kernel.org, kernel-hardening@lists.openwall.com Return-path: List-Post: List-Help: List-Unsubscribe: List-Subscribe: In-Reply-To: <20171021134303.20685-1-nicolas@belouin.fr> Content-Language: en-US List-Id: linux-ext4.vger.kernel.org On 10/21/2017 6:43 AM, Nicolas Belouin wrote: > With CAP_SYS_ADMIN being bloated and inapropriate for actions such > as mounting/unmounting filesystems, the creation of a new capability > is needed. > CAP_SYS_MOUNT is meant to give a process the ability to call for mount, > umount and umount2 syscalls. This is increased granularity for it's own sake. There is no compelling reason to break out this capability in particular. Can you identify existing use cases where you would have CAP_SYS_MOUNT without also having CAP_SYS_ADMIN? I should think that all the work that's gone into unprivileged mounts over the past couple years would make this unnecessary. > Signed-off-by: Nicolas Belouin > --- > include/uapi/linux/capability.h | 5 ++++- > security/selinux/include/classmap.h | 4 ++-- > 2 files changed, 6 insertions(+), 3 deletions(-) > > diff --git a/include/uapi/linux/capability.h b/include/uapi/linux/capability.h > index 230e05d35191..ce230aa6d928 100644 > --- a/include/uapi/linux/capability.h > +++ b/include/uapi/linux/capability.h > @@ -365,8 +365,11 @@ struct vfs_ns_cap_data { > > #define CAP_AUDIT_READ 37 > > +/* Allow mounting, unmounting filesystems */ > > -#define CAP_LAST_CAP CAP_AUDIT_READ > +#define CAP_SYS_MOUNT 38 > + > +#define CAP_LAST_CAP CAP_SYS_MOUNT > > #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) > > diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h > index 35ffb29a69cb..a873dce97fd5 100644 > --- a/security/selinux/include/classmap.h > +++ b/security/selinux/include/classmap.h > @@ -24,9 +24,9 @@ > "audit_control", "setfcap" > > #define COMMON_CAP2_PERMS "mac_override", "mac_admin", "syslog", \ > - "wake_alarm", "block_suspend", "audit_read" > + "wake_alarm", "block_suspend", "audit_read", "sys_mount" > > -#if CAP_LAST_CAP > CAP_AUDIT_READ > +#if CAP_LAST_CAP > CAP_SYS_MOUNT > #error New capability defined, please update COMMON_CAP2_PERMS. > #endif >