execve setting capabilities incorrectly ?

execve setting capabilities incorrectly ?

[Don Cohen]

Please cc me in replies.

quoting from message dated 1998/06 to this list from Andrew Morgan
 Subject: Fwd: Re: Capabilities 
 ...
 [root@godzilla progs]# ./execcap cap_net_bind_service=i sleep 1000 &
 [1] 600
 [root@godzilla progs]# cat /proc/600/status 
 ...
 CapInh: 0000000000000400
 CapPrm: 0000000000000400
 CapEff: 0000000000000400

My corresponding output ends up with
 CapInh: 0000000000000400
 CapPrm: 00000000fffffeff
 CapEff: 00000000fffffeff

I've tried in 2.4.18 and in 2.2.16, both give the same result so
I guess it's been this way for some time.

The caps seem to be set correctly by execcap but execve resets them. 
Is this intentional?  
If so, how is one now supposed to get the desired effects? 


What's really weird (can someone explain this?) is that things
seem to work better under strace:
 strace ./execcap = head <some file root has no permission to read>
=> permission denied
whereas without the strace it reads the file.

Re: execve setting capabilities incorrectly ?

[Andrew Morgan]

execcap doesn't work.

Long story: Linux capabilities don't really work as POSIX intended them 
to work without filesystem support. I am not working on this these days, 
although there are some mostly complete patches on kernel.org for old 
kernels.

Because of the ambiguity of what setuid() does with the behavior I 
discussed in this old email, when combined with certain setuid-0 
programs, we had to make the kernel's default policy less like POSIX and 
more like the legacy superuser model.

You used to be able to make it work as it did in the examples below by 
raising the inheritable set and lowering the cap_bound set (which is 
another hack POSIX didn't specify).

In the absence of filesystem support for capabilities, various folk have 
come up with their own ways of leveraging the capabilities to implement 
some security models. I fear that completing the capability support as 
the POSIX draft defines them will break these other approaches.

I hope that helps clarify what you are seeing.

Cheers

Andrew [who isn't subscribed to the kernel mailing list.]

Don Cohen wrote:
> Please cc me in replies.
> 
> quoting from message dated 1998/06 to this list from Andrew Morgan
>  Subject: Fwd: Re: Capabilities 
>  ...
>  [root@godzilla progs]# ./execcap cap_net_bind_service=i sleep 1000 &
>  [1] 600
>  [root@godzilla progs]# cat /proc/600/status 
>  ...
>  CapInh: 0000000000000400
>  CapPrm: 0000000000000400
>  CapEff: 0000000000000400
> 
> My corresponding output ends up with
>  CapInh: 0000000000000400
>  CapPrm: 00000000fffffeff
>  CapEff: 00000000fffffeff
> 
> I've tried in 2.4.18 and in 2.2.16, both give the same result so
> I guess it's been this way for some time.
> 
> The caps seem to be set correctly by execcap but execve resets them. 
> Is this intentional?  
> If so, how is one now supposed to get the desired effects? 
> 
> 
> What's really weird (can someone explain this?) is that things
> seem to work better under strace:
>  strace ./execcap = head <some file root has no permission to read>
> => permission denied
> whereas without the strace it reads the file.
> 

Re: execve setting capabilities incorrectly ?

[Don Cohen]

Andrew Morgan writes:
 > execcap doesn't work...

Thanks.
Could I suggest appropriate updates to
http://ftp.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.4/capfaq-0.2.txt
(which caused me to waste a day or so).
I hope the people who can make such updates read this list.

I'd also appreciate pointers to other mechanisms for accomplishing the
same goals.  (And perhaps these belong in the above update too.)

Which still leaves the question of what strace has to do with it.