From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755408AbbB0U5G (ORCPT ); Fri, 27 Feb 2015 15:57:06 -0500 Received: from mail-lb0-f181.google.com ([209.85.217.181]:34813 "EHLO mail-lb0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755268AbbB0U5D (ORCPT ); Fri, 27 Feb 2015 15:57:03 -0500 MIME-Version: 1.0 In-Reply-To: <20150227204833.GA18200@amd> References: <20150202171257.GD24351@ubuntumail> <20150225215014.GD29527@amd> <20150226122707.GA27733@Nokia-N900> <20150227204833.GA18200@amd> From: Andy Lutomirski Date: Fri, 27 Feb 2015 12:56:41 -0800 Message-ID: Subject: Re: [capabilities] Allow normal inheritance for a configurable set of capabilities To: Pavel Machek Cc: Christoph Lameter , Serge Hallyn , Serge Hallyn , Jonathan Corbet , Aaron Jones , "Ted Ts'o" , LSM List , "linux-kernel@vger.kernel.org" , Andrew Morton , "Andrew G. Morgan" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Feb 27, 2015 at 12:48 PM, Pavel Machek wrote: > On Fri 2015-02-27 12:15:15, Andy Lutomirski wrote: >> On Thu, Feb 26, 2015 at 4:27 AM, Pavel Machek wrote: >> > On Wed 2015-02-25 17:59:04, Christoph Lameter wrote: >> >> On Wed, 25 Feb 2015, Pavel Machek wrote: >> >> >> >> > One solution is to put capabilities into the elf executable. I believe >> >> > there was patch for that. That means you don't need to add capability >> >> > support into filesystems... >> >> >> >> Ummm... So I can just get any caps by modifying the ELF header? >> >> Looking at the docs No, it just drops caps so binaries must be >> >> setsuid. >> > >> > exactly. Normal apps are not currently allowed to receive >> > capabilities, because they may not be ready for them. >> > >> > So add an elf note marking what capabilities it can deal with. >> > No need for setuid if caller has the capabilities already. >> >> We'd need extremely broad coverage for this to be useful because of >> shells, pipelines, scripts, etc. We'd need bash, env, python, etc. > > Well.. capabilities for scripts will be "fun" even when you have > proper filesystem support. I'd say that is separate problem... (and > yes, it would have to be solved.) To me, however, the whole point of this thread is that you shouldn't need filesystem support at all. If I have CAP_WHATEVER, I tell the kernel that I want my children to have CAP_WHATEVER in their permitted and effective sets, and I don't try to run a setuid or fP != 0 program, then it should just work. The insertion of scripts in the way shouldn't matter. --Andy > > -- > (english) http://www.livejournal.com/~pavelmachek > (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html -- Andy Lutomirski AMA Capital Management, LLC