Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in systems using capabilities

From: Austin S Hemmelgarn <ahferroin7@gmail.com>
To: "Theodore Ts'o" <tytso@mit.edu>,
	Andy Lutomirski <luto@amacapital.net>,
	Serge Hallyn <serge.hallyn@ubuntu.com>,
	Kees Cook <keescook@chromium.org>,
	Christoph Lameter <cl@linux.com>,
	"Serge E. Hallyn" <serge@hallyn.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Richard Weinberger <richard.weinberger@gmail.com>,
	LKML <linux-kernel@vger.kernel.org>,
	Linus Torvalds <torvalds@linux-foundation.org>
Subject: Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in systems using capabilities
Date: Tue, 10 Nov 2015 08:35:51 -0500	[thread overview]
Message-ID: <5641F2B7.9050408@gmail.com> (raw)
In-Reply-To: <20151110131907.GB2958@ikki.ethgen.ch>

[-- Attachment #1: Type: text/plain, Size: 1352 bytes --]

On 2015-11-10 08:19, Klaus Ethgen wrote:
> Hi Ted, hy others in this discussion,
>
> Am Di den 10. Nov 2015 um 13:40 schrieb Theodore Ts'o:
>> Whether or not that will be acceptable upstream, I don't know, mainly
>> because I think a strong case can be made that such a patch has an
>> audience of one, and adding more complexity here for an idea which has
>> been time-tested over decades to be a failure is just not a good idea.
>
> I wouldn't tell the implementation until now to be a failure. It helped
> a lot to keep a system sane. It is true that all distributions ignored
> capabilities completely but I don't think that is due the design.
I think it's mostly due to the fact that there are a lot of potential 
security issues in using capabilities as implemented in Linux (and other 
POSIX systems), and unlike chroot(), it's not as easy to protect against 
stuff trying to bypass them while still keeping them useful. If you do a 
web search you can relatively easily find info on how to use many of the 
defined capabilities to get root-equivalent access (CAP_SYS_ADMIN and 
CAP_SYS_MODULE are obvious, but many of the others can be used also if 
you know what you are doing, for example CAP_DAC_OVERRIDE+CAP_SYS_BOOT 
can be used on non-SecureBoot systems to force the system to reboot into 
an arbitrary kernel).


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 3019 bytes --]