From: David Drysdale <drysdale@google.com> To: Andy Lutomirski <luto@amacapital.net> Cc: LSM List <linux-security-module@vger.kernel.org>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Alexander Viro <viro@zeniv.linux.org.uk>, Meredydd Luff <meredydd@senatehouse.org>, Kees Cook <keescook@chromium.org>, James Morris <james.l.morris@oracle.com>, Linux API <linux-api@vger.kernel.org> Subject: Re: [PATCH 4/5] man-pages: cap_rights_limit.2: limit FD rights for Capsicum Date: Mon, 30 Jun 2014 16:35:03 +0100 [thread overview] Message-ID: <20140630153503.GA10375@google.com> (raw) In-Reply-To: <CALCETrUi71FgVABRF4C+n_STc02j=GxRwBqDaoC+NLeAP9Ui3w@mail.gmail.com> On Mon, Jun 30, 2014 at 07:53:57AM -0700, Andy Lutomirski wrote: > On Mon, Jun 30, 2014 at 3:28 AM, David Drysdale <drysdale@google.com> wrote: > > Signed-off-by: David Drysdale <drysdale@google.com> > > --- > > man2/cap_rights_limit.2 | 171 ++++++++++++++++++++++++++++++++++++++++++++++++ > > 1 file changed, 171 insertions(+) > > create mode 100644 man2/cap_rights_limit.2 > > > > diff --git a/man2/cap_rights_limit.2 b/man2/cap_rights_limit.2 > > new file mode 100644 > > index 000000000000..3484ee1076aa > > --- /dev/null > > +++ b/man2/cap_rights_limit.2 > > @@ -0,0 +1,171 @@ > > +.\" > > +.\" Copyright (c) 2008-2010 Robert N. M. Watson > > +.\" Copyright (c) 2012-2013 The FreeBSD Foundation > > +.\" Copyright (c) 2013-2014 Google, Inc. > > +.\" All rights reserved. > > +.\" > > +.\" %%%LICENSE_START(BSD_2_CLAUSE) > > +.\" Redistribution and use in source and binary forms, with or without > > +.\" modification, are permitted provided that the following conditions > > +.\" are met: > > +.\" 1. Redistributions of source code must retain the above copyright > > +.\" notice, this list of conditions and the following disclaimer. > > +.\" 2. Redistributions in binary form must reproduce the above copyright > > +.\" notice, this list of conditions and the following disclaimer in the > > +.\" documentation and/or other materials provided with the distribution. > > +.\" > > +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND > > +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE > > +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE > > +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE > > +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL > > +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS > > +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) > > +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT > > +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY > > +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF > > +.\" SUCH DAMAGE. > > +.\" %%%LICENSE_END > > +.\" > > +.TH CAP_RIGHTS_LIMIT 2 2014-05-07 "Linux" "Linux Programmer's Manual" > > +.SH NAME > > +cap_rights_limit \- limit Capsicum capability rights > > +.SH SYNOPSIS > > +.nf > > +.B #include <sys/capsicum.h> > > +.sp > > +.BI "int cap_rights_limit(int " fd ", const struct cap_rights *" rights , > > +.BI " unsigned int " fcntls , > > +.BI " int " nioctls ", unsigned int *" ioctls ); > > Am I missing the docs for struct cap_rights somewhere? There's a little bit of discussion in rights.7 (mail 3/5 of the man-pages set), but there isn't a structure description. I was trying to keep the structure opaque to userspace, which would be expected to manipulate the rights with various utility functions rather than directly. But I now realize this leaves a gap -- the description of this syscall doesn't include a full description of its ABI. So I'll add in a description of the structure to this page -- basically: struct cap_rights { __u64 cr_rights[2]; }; with a slightly complicated scheme to encode rights into the bitmask array. (The encoding scheme is taken from the FreeBSD implementation, which I've tried to stick to unless there's good reason to change.) > > +.SH DESCRIPTION > > +When a file descriptor is created by a function such as > > +.BR accept (2), > > +.BR accept4 (2), > > +.BR creat (2), > > +.BR epoll_create (2), > > +.BR eventfd (2), > > +.BR mq_open (2), > > +.BR open (2), > > +.BR openat (2), > > +.BR pdfork (2), > > +.BR pipe (2), > > +.BR pipe2 (2), > > +.BR signalfd (2), > > +.BR socket (2), > > +.BR socketpair (2) > > +or > > +.BR timerfd_create (2), > > +it implicitly has all Capsicum capability rights. > > +Those rights can be reduced (but never expanded) by using the > > +.BR cap_rights_limit () > > +system call. > > +Once Capsicum capability rights are reduced, operations on the file descriptor > > +.I fd > > +will be limited to those permitted by the remainder of the arguments. > > +.PP > > +The > > +.I rights > > +argument describes the primary rights for the file descriptor, and > > +should be prepared using > > +.BR cap_rights_init (3) > > +family of functions. The complete list of primary rights can be found in the > > +.BR rights (7) > > +manual page. > > +.PP > > +If a file descriptor is granted the > > +.B CAP_FCNTL > > +primary capability right, the list of allowed > > +.BR fcntl (2) > > +commands can be selectively reduced (but never expanded) with the > > +.I fcntls > > +argument. The following flags may be specified in the > > +.I fcntls > > +argument: > > +.TP > > +.B CAP_FCNTL_GETFL > > +Permit > > +.B F_GETFL > > +command. > > +.TP > > +.B CAP_FCNTL_SETFL > > +Permit > > +.B F_SETFL > > +command. > > +.TP > > +.B CAP_FCNTL_GETOWN > > +Permit > > +.B F_GETOWN > > +command. > > +.TP > > +.B CAP_FCNTL_SETOWN > > +Permit > > +.B F_SETOWN > > +command. > > +.PP > > +A value of > > +.B CAP_FCNTL_ALL > > +for the > > +.I fcntls > > +argument leaves the set of allowed > > +.BR fcntl (2) > > +commands unchanged. > > What about the locking fcntl operations? (Arguably the old crappy > POSIX lock operations should be flat-out disallowed on capability fds, > but I see nothing wrong with selectively allowing the new open file > description locks.) > > --Andy The locking operations are policed against a separate CAP_FLOCK right, consistently with flock(2). I'll try to improve the wording -- there are actually a few fcntl operations that are covered by different rights because they're analogous to other functionality (e.g. F_GETPIPE_SZ/F_SETPIPE_SZ needs CAP_GETSOCKOPT/CAP_SETSOCKOPT).
WARNING: multiple messages have this Message-ID (diff)
From: David Drysdale <drysdale-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org> To: Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org> Cc: LSM List <linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>, "linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" <linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>, Greg Kroah-Hartman <gregkh-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org>, Alexander Viro <viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org>, Meredydd Luff <meredydd-zPN50pYk8eUaUu29zAJCuw@public.gmane.org>, Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>, James Morris <james.l.morris-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>, Linux API <linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org> Subject: Re: [PATCH 4/5] man-pages: cap_rights_limit.2: limit FD rights for Capsicum Date: Mon, 30 Jun 2014 16:35:03 +0100 [thread overview] Message-ID: <20140630153503.GA10375@google.com> (raw) In-Reply-To: <CALCETrUi71FgVABRF4C+n_STc02j=GxRwBqDaoC+NLeAP9Ui3w-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org> On Mon, Jun 30, 2014 at 07:53:57AM -0700, Andy Lutomirski wrote: > On Mon, Jun 30, 2014 at 3:28 AM, David Drysdale <drysdale-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org> wrote: > > Signed-off-by: David Drysdale <drysdale-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org> > > --- > > man2/cap_rights_limit.2 | 171 ++++++++++++++++++++++++++++++++++++++++++++++++ > > 1 file changed, 171 insertions(+) > > create mode 100644 man2/cap_rights_limit.2 > > > > diff --git a/man2/cap_rights_limit.2 b/man2/cap_rights_limit.2 > > new file mode 100644 > > index 000000000000..3484ee1076aa > > --- /dev/null > > +++ b/man2/cap_rights_limit.2 > > @@ -0,0 +1,171 @@ > > +.\" > > +.\" Copyright (c) 2008-2010 Robert N. M. Watson > > +.\" Copyright (c) 2012-2013 The FreeBSD Foundation > > +.\" Copyright (c) 2013-2014 Google, Inc. > > +.\" All rights reserved. > > +.\" > > +.\" %%%LICENSE_START(BSD_2_CLAUSE) > > +.\" Redistribution and use in source and binary forms, with or without > > +.\" modification, are permitted provided that the following conditions > > +.\" are met: > > +.\" 1. Redistributions of source code must retain the above copyright > > +.\" notice, this list of conditions and the following disclaimer. > > +.\" 2. Redistributions in binary form must reproduce the above copyright > > +.\" notice, this list of conditions and the following disclaimer in the > > +.\" documentation and/or other materials provided with the distribution. > > +.\" > > +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND > > +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE > > +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE > > +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE > > +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL > > +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS > > +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) > > +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT > > +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY > > +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF > > +.\" SUCH DAMAGE. > > +.\" %%%LICENSE_END > > +.\" > > +.TH CAP_RIGHTS_LIMIT 2 2014-05-07 "Linux" "Linux Programmer's Manual" > > +.SH NAME > > +cap_rights_limit \- limit Capsicum capability rights > > +.SH SYNOPSIS > > +.nf > > +.B #include <sys/capsicum.h> > > +.sp > > +.BI "int cap_rights_limit(int " fd ", const struct cap_rights *" rights , > > +.BI " unsigned int " fcntls , > > +.BI " int " nioctls ", unsigned int *" ioctls ); > > Am I missing the docs for struct cap_rights somewhere? There's a little bit of discussion in rights.7 (mail 3/5 of the man-pages set), but there isn't a structure description. I was trying to keep the structure opaque to userspace, which would be expected to manipulate the rights with various utility functions rather than directly. But I now realize this leaves a gap -- the description of this syscall doesn't include a full description of its ABI. So I'll add in a description of the structure to this page -- basically: struct cap_rights { __u64 cr_rights[2]; }; with a slightly complicated scheme to encode rights into the bitmask array. (The encoding scheme is taken from the FreeBSD implementation, which I've tried to stick to unless there's good reason to change.) > > +.SH DESCRIPTION > > +When a file descriptor is created by a function such as > > +.BR accept (2), > > +.BR accept4 (2), > > +.BR creat (2), > > +.BR epoll_create (2), > > +.BR eventfd (2), > > +.BR mq_open (2), > > +.BR open (2), > > +.BR openat (2), > > +.BR pdfork (2), > > +.BR pipe (2), > > +.BR pipe2 (2), > > +.BR signalfd (2), > > +.BR socket (2), > > +.BR socketpair (2) > > +or > > +.BR timerfd_create (2), > > +it implicitly has all Capsicum capability rights. > > +Those rights can be reduced (but never expanded) by using the > > +.BR cap_rights_limit () > > +system call. > > +Once Capsicum capability rights are reduced, operations on the file descriptor > > +.I fd > > +will be limited to those permitted by the remainder of the arguments. > > +.PP > > +The > > +.I rights > > +argument describes the primary rights for the file descriptor, and > > +should be prepared using > > +.BR cap_rights_init (3) > > +family of functions. The complete list of primary rights can be found in the > > +.BR rights (7) > > +manual page. > > +.PP > > +If a file descriptor is granted the > > +.B CAP_FCNTL > > +primary capability right, the list of allowed > > +.BR fcntl (2) > > +commands can be selectively reduced (but never expanded) with the > > +.I fcntls > > +argument. The following flags may be specified in the > > +.I fcntls > > +argument: > > +.TP > > +.B CAP_FCNTL_GETFL > > +Permit > > +.B F_GETFL > > +command. > > +.TP > > +.B CAP_FCNTL_SETFL > > +Permit > > +.B F_SETFL > > +command. > > +.TP > > +.B CAP_FCNTL_GETOWN > > +Permit > > +.B F_GETOWN > > +command. > > +.TP > > +.B CAP_FCNTL_SETOWN > > +Permit > > +.B F_SETOWN > > +command. > > +.PP > > +A value of > > +.B CAP_FCNTL_ALL > > +for the > > +.I fcntls > > +argument leaves the set of allowed > > +.BR fcntl (2) > > +commands unchanged. > > What about the locking fcntl operations? (Arguably the old crappy > POSIX lock operations should be flat-out disallowed on capability fds, > but I see nothing wrong with selectively allowing the new open file > description locks.) > > --Andy The locking operations are policed against a separate CAP_FLOCK right, consistently with flock(2). I'll try to improve the wording -- there are actually a few fcntl operations that are covered by different rights because they're analogous to other functionality (e.g. F_GETPIPE_SZ/F_SETPIPE_SZ needs CAP_GETSOCKOPT/CAP_SETSOCKOPT).
next prev parent reply other threads:[~2014-06-30 15:35 UTC|newest] Thread overview: 87+ messages / expand[flat|nested] mbox.gz Atom feed top 2014-06-30 10:28 [RFC PATCH 00/11] Adding FreeBSD's Capsicum security framework (part 1) David Drysdale 2014-06-30 10:28 ` [PATCH 01/11] fs: add O_BENEATH_ONLY flag to openat(2) David Drysdale 2014-06-30 14:49 ` Andy Lutomirski 2014-06-30 15:49 ` David Drysdale 2014-06-30 15:53 ` Andy Lutomirski 2014-07-08 12:07 ` Christoph Hellwig 2014-07-08 12:07 ` Christoph Hellwig 2014-07-08 12:48 ` Meredydd Luff 2014-07-08 12:48 ` Meredydd Luff 2014-07-08 12:51 ` Christoph Hellwig 2014-07-08 12:51 ` Christoph Hellwig 2014-07-08 13:04 ` Meredydd Luff 2014-07-08 13:04 ` Meredydd Luff 2014-07-08 13:12 ` Christoph Hellwig 2014-06-30 20:40 ` Andi Kleen 2014-06-30 21:11 ` Andy Lutomirski 2014-07-01 9:53 ` David Drysdale 2014-07-01 9:53 ` David Drysdale 2014-07-01 18:58 ` Loganaden Velvindron 2014-07-08 12:03 ` Christoph Hellwig 2014-07-08 12:03 ` Christoph Hellwig 2014-07-08 16:54 ` David Drysdale 2014-07-08 16:54 ` David Drysdale 2014-07-09 8:48 ` Christoph Hellwig 2014-06-30 10:28 ` [PATCH 02/11] selftests: Add test of O_BENEATH_ONLY & openat(2) David Drysdale 2014-06-30 10:28 ` David Drysdale 2014-06-30 10:28 ` [PATCH 03/11] capsicum: rights values and structure definitions David Drysdale 2014-06-30 10:28 ` David Drysdale 2014-06-30 10:28 ` [PATCH 04/11] capsicum: implement fgetr() and friends David Drysdale 2014-06-30 10:28 ` David Drysdale 2014-06-30 10:28 ` [PATCH 05/11] capsicum: convert callers to use fgetr() etc David Drysdale 2014-06-30 10:28 ` [PATCH 06/11] capsicum: implement sockfd_lookupr() David Drysdale 2014-06-30 10:28 ` [PATCH 07/11] capsicum: convert callers to use sockfd_lookupr() etc David Drysdale 2014-06-30 10:28 ` [PATCH 08/11] capsicum: add new LSM hooks on FD/file conversion David Drysdale 2014-06-30 10:28 ` [PATCH 09/11] capsicum: implementations of new LSM hooks David Drysdale 2014-06-30 16:05 ` Andy Lutomirski 2014-06-30 16:05 ` Andy Lutomirski 2014-07-02 13:49 ` Paul Moore 2014-07-02 13:49 ` Paul Moore 2014-07-02 17:09 ` David Drysdale 2014-07-02 17:09 ` David Drysdale 2014-06-30 10:28 ` [PATCH 10/11] capsicum: invocation " David Drysdale 2014-06-30 10:28 ` [PATCH 11/11] capsicum: add syscalls to limit FD rights David Drysdale 2014-06-30 10:28 ` [PATCH 1/5] man-pages: open.2: describe O_BENEATH_ONLY flag David Drysdale 2014-06-30 22:22 ` Andy Lutomirski 2014-06-30 10:28 ` [PATCH 2/5] man-pages: capsicum.7: describe Capsicum capability framework David Drysdale 2014-06-30 10:28 ` [PATCH 3/5] man-pages: rights.7: Describe Capsicum primary rights David Drysdale 2014-06-30 10:28 ` [PATCH 4/5] man-pages: cap_rights_limit.2: limit FD rights for Capsicum David Drysdale 2014-06-30 14:53 ` Andy Lutomirski 2014-06-30 14:53 ` Andy Lutomirski 2014-06-30 15:35 ` David Drysdale [this message] 2014-06-30 15:35 ` David Drysdale 2014-06-30 16:06 ` Andy Lutomirski 2014-06-30 16:06 ` Andy Lutomirski 2014-06-30 16:32 ` David Drysdale 2014-06-30 10:28 ` [PATCH 5/5] man-pages: cap_rights_get: retrieve Capsicum fd rights David Drysdale 2014-06-30 22:28 ` Andy Lutomirski 2014-06-30 22:28 ` Andy Lutomirski 2014-07-01 9:19 ` David Drysdale 2014-07-01 9:19 ` David Drysdale 2014-07-01 14:18 ` Andy Lutomirski 2014-07-03 9:12 ` [RFC PATCH 00/11] Adding FreeBSD's Capsicum security framework (part 1) Paolo Bonzini 2014-07-03 9:12 ` [Qemu-devel] " Paolo Bonzini 2014-07-03 10:01 ` Loganaden Velvindron 2014-07-03 10:01 ` [Qemu-devel] " Loganaden Velvindron 2014-07-03 18:39 ` David Drysdale 2014-07-03 18:39 ` [Qemu-devel] " David Drysdale 2014-07-03 18:39 ` David Drysdale 2014-07-04 7:03 ` Paolo Bonzini 2014-07-04 7:03 ` [Qemu-devel] " Paolo Bonzini 2014-07-04 7:03 ` Paolo Bonzini 2014-07-07 10:29 ` David Drysdale 2014-07-07 10:29 ` [Qemu-devel] " David Drysdale 2014-07-07 12:20 ` Paolo Bonzini 2014-07-07 12:20 ` [Qemu-devel] " Paolo Bonzini 2014-07-07 14:11 ` David Drysdale 2014-07-07 14:11 ` [Qemu-devel] " David Drysdale 2014-07-07 14:11 ` David Drysdale 2014-07-07 22:33 ` Alexei Starovoitov 2014-07-07 22:33 ` [Qemu-devel] " Alexei Starovoitov 2014-07-07 22:33 ` Alexei Starovoitov 2014-07-08 14:58 ` Kees Cook 2014-07-08 14:58 ` [Qemu-devel] " Kees Cook 2014-07-08 14:58 ` Kees Cook 2014-08-16 15:41 ` Pavel Machek 2014-08-16 15:41 ` [Qemu-devel] " Pavel Machek 2014-08-16 15:41 ` Pavel Machek
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20140630153503.GA10375@google.com \ --to=drysdale@google.com \ --cc=gregkh@linuxfoundation.org \ --cc=james.l.morris@oracle.com \ --cc=keescook@chromium.org \ --cc=linux-api@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=luto@amacapital.net \ --cc=meredydd@senatehouse.org \ --cc=viro@zeniv.linux.org.uk \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.