Re: [capabilities] Allow normal inheritance for a configurable set of capabilities

From: Christoph Lameter <cl@linux.com>
To: Andy Lutomirski <luto@amacapital.net>
Cc: Casey Schaufler <casey@schaufler-ca.com>,
	"Serge E. Hallyn" <serge@hallyn.com>,
	Serge Hallyn <serge.hallyn@ubuntu.com>,
	Serge Hallyn <serge.hallyn@canonical.com>,
	Jonathan Corbet <corbet@lwn.net>,
	Aaron Jones <aaronmdjones@gmail.com>, "Ted Ts'o" <tytso@mit.edu>,
	LSM List <linux-security-module@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	Andrew Morton <akpm@linuxfoundation.org>
Subject: Re: [capabilities] Allow normal inheritance for a configurable set of capabilities
Date: Tue, 3 Feb 2015 17:14:04 -0600 (CST)	[thread overview]
Message-ID: <alpine.DEB.2.11.1502031708100.9261@gentwo.org> (raw)
In-Reply-To: <CALCETrVbGo1M4tg2b-hcaimEXsXFCYVOyJHZFm3vw=6TqqfaAw@mail.gmail.com>

On Tue, 3 Feb 2015, Andy Lutomirski wrote:

> >                  */
> >                 new->cap_permitted.cap[i] =
> >                         (new->cap_bset.cap[i] & permitted) |
> > -                       (new->cap_inheritable.cap[i] & inheritable);
> > +                       (new->cap_inheritable.cap[i] & inheritable) |
> > +                       (ambient & inheritable);
>
> Is there a clear reason why no non-permitted bits can be inheritable?
> If not, then I think this should be (ambient & inheritable &
> permitted).

Inherited caps via ambient are always be permitted. Otherwise the pass
through is not working.

> Do we need to think about the effective mask here?  What happens when
> we exec a setuid program or a program with a non-empty fP set?  I
> think that, in these cases, we should strongly consider clearing the
> ambient set.  For a different approach, see below.
>
> >
> >                 if (permitted & ~new->cap_permitted.cap[i])
> >                         /* insufficient to execute correctly */
> >                         ret = -EPERM;
> > +
> > +               if (capable(CAP_AMBIENT_MASK))
> > +                       new->cap_ambient.cap[i] = inheritable;
> > +               else
> > +                       new->cap_ambient.cap[i] = ambient;
>
> IMO this is really weird.  I don't think that the presence of an
> effective cap should change the cap equations.  (Also, that should be
> nsown_capable.)

Well how would the ambient mask to be set? The other options are adding a
new syscall and having to go through an interation of the capabilities
tools and/or kernel syscall API changes.

> Can we please make this an explicit opt-in?  For example, allow a
> process to set an ambient cap bit if that bit is both permitted and
> inheritable.  I'd prefer having it be a single control, though -- just
> prctl(PR_SET_ALWAYS_INHERIT_CAPS, 1, 0, 0, 0) would set a single bit
> that would cause all inheritable bits to be treated as ambient.

Opt-in does not work since the caps need to be passed
through binaries that do not use the capabilities.

> Here's a slight variant that might be more clearly safe: add an
> inherited per-process bit that causes all files to act as though fI is
> the full set.  Only allow setting that bit if no_new_privs is set.

CAP_INHERIT_ALL ?