From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753269AbbKHRF4 (ORCPT ); Sun, 8 Nov 2015 12:05:56 -0500 Received: from h2.hallyn.com ([78.46.35.8]:44878 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751897AbbKHRFx (ORCPT ); Sun, 8 Nov 2015 12:05:53 -0500 Date: Sun, 8 Nov 2015 11:05:52 -0600 From: "Serge E. Hallyn" To: Klaus Ethgen Cc: "Serge E. Hallyn" , "Theodore Ts'o" , Andy Lutomirski , Linus Torvalds , Richard Weinberger , LKML , Christoph Lameter , Andy Lutomirski , Serge Hallyn , Kees Cook , Andrew Morton Subject: Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities Message-ID: <20151108170552.GA3122@mail.hallyn.com> References: <20151105171701.GB9307@ikki.ethgen.ch> <20151105173438.GA3378@mail.hallyn.com> <20151105174823.GD9307@ikki.ethgen.ch> <20151105220843.GA6027@mail.hallyn.com> <20151106135835.GB11901@ikki.ethgen.ch> <20151106155303.GB6160@thunk.org> <20151106175619.GA19491@ikki.ethgen.ch> <20151106181820.GB16749@mail.hallyn.com> <20151107110246.GA7230@ikki.ethgen.ch> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20151107110246.GA7230@ikki.ethgen.ch> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, Nov 07, 2015 at 12:02:47PM +0100, Klaus Ethgen wrote: > Hi Guys, > > Am Fr den 6. Nov 2015 um 19:18 schrieb Serge E. Hallyn: > > I would have been happy if there had been a default-off PR_ENABLE_AMBIENT > > prctl which required a new CAP_ENABLE_AMBIENT capability to turn on, but > > the current set of rules which removes bits from pA whenever doing an > > action which capability-aware software does something which it would have > > reasonably expected to drop privilege is a nice safeguard. > > Well, not really. You can only prevent ambient capabilities to be given > to tools you don't want to have any capabilities by setting that tool > SUID or setting just one random capability for it. Right, I didn't say you could say "/bin/foo is never run with capabilities." Rather, if a piece of software specifically tries to drop all privilege before running a piece of software, then ambient capabilities is designed to honor that. > By the way, guys, can we start to _not_ add every one in this discussion > to the Cc? Currently I get every mail twice. One from the list and one > from Cc. I still leave all Ccs intact with this mail but I would prefer > to just reply to the list. If anybody is not reading the list and would > like to get the mail, please insist. That is (a) hard to do becase we don't know who is on the list, and (2) not useful with lkml in particular because many people read only email directly To them, not lkml email. (My procmail filters my name to my inbox, so I typically get 3-4 copies; easily handled)