From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S967028AbbBEAek (ORCPT ); Wed, 4 Feb 2015 19:34:40 -0500 Received: from h2.hallyn.com ([78.46.35.8]:41017 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755922AbbBEAeh (ORCPT ); Wed, 4 Feb 2015 19:34:37 -0500 Date: Thu, 5 Feb 2015 01:34:34 +0100 From: "Serge E. Hallyn" To: "Andrew G. Morgan" Cc: "Serge E. Hallyn" , Christoph Lameter , casey@schaufler-ca.com, Andy Lutomirski , Jonathan Corbet , Aaron Jones , "Ted Ts'o" , linux-security-module@vger.kernel.org, lkml , akpm@linuxfoundation.org Subject: Re: [capabilities] Allow normal inheritance for a configurable set of capabilities Message-ID: <20150205003434.GC23013@mail.hallyn.com> References: <20150202171257.GD24351@ubuntumail> <20150203155544.GE2923@mail.hallyn.com> <20150203172653.GB4748@mail.hallyn.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Quoting Andrew G. Morgan (morgan@kernel.org): > I'm not generally in favor of this. Mostly because this seems to be a > mini-root kind of inheritance that propagates privilege to binaries > that aren't prepared for privilege. Earlier in this thread, Casey said: | One of the holes in the 1003.1e spec is what to do with a program file | that does not have a capability set attached to it. The two options are | drop all capabilities and leave the capabilities alone. The latter gives | you what you're asking for. The former is arguably safer. and | It's what we did in Trusted Irix. It made life much easier. I'm going to need to clear my head a bit before I try to compare that to the root cause of the sendmail capabilities bug. > I don't really buy the mmap code > concern because the model as it stands says that you trust the binary > (and all of the various ways it was programmed to execute code) with > specific privileges. If the binary mmap's some code (PAM modules come > to mind) then that is part of what it was programmed to/allowed to do. That's not really the point... The point is that yes, a mini-root is exactly what is being asked for :) I'm not saying I expect an adversary to do the mmap+jump, but that currently it is a, and the only, way to do unprivileged userid with retaining some privileges to run legacy programs. > That being said, if you really really want this kind of thing, then > make it a single secure bit (with another lock on/off bit) which, when > set, makes: fI default to X. > > pP' = (X & fP) | (pI & fI) > > That way the per-process bounding set still works as advertised and > you don't need to worry about the existing semantics being violated. Maybe that is the way to go... -serge