From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753781AbbCJPr3 (ORCPT ); Tue, 10 Mar 2015 11:47:29 -0400 Received: from resqmta-ch2-02v.sys.comcast.net ([69.252.207.34]:40778 "EHLO resqmta-ch2-02v.sys.comcast.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753053AbbCJPrZ (ORCPT ); Tue, 10 Mar 2015 11:47:25 -0400 Date: Tue, 10 Mar 2015 10:47:22 -0500 (CDT) From: Christoph Lameter X-X-Sender: cl@gentwo.org To: "Andrew G. Morgan" cc: "Serge E. Hallyn" , LSM List , Serge Hallyn , Michael Kerrisk , Jonathan Corbet , Linux API , Mimi Zohar , Aaron Jones , Andy Lutomirski , Austin S Hemmelgarn , Jarkko Sakkinen , Andrew Morton , Markku Savela , "linux-kernel@vger.kernel.org" Subject: Re: [PATCH] capabilities: Ambient capability set V2 In-Reply-To: Message-ID: References: <20150305171326.GA14998@mail.hallyn.com> <20150306163443.GA28386@mail.hallyn.com> <20150306200838.GA29198@mail.hallyn.com> <20150307213554.GB9833@mail.hallyn.com> <20150309143653.GA29594@mail.hallyn.com> Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 9 Mar 2015, Andrew G. Morgan wrote: > If this is new info, perhaps you might reconsider the rationale for your > patch? I suspect you are focused on addressing a problem that you felt was > unaddressed before, but given how much appears to have been unclear to you > about the current implementation it might be worth a pause for thought. The problems with unclear documentation and a weird counterintuitive implementation that lots of people have trouble to use do not impact the approach as far as I can tell. The discovery about how to set inheritable bits does not help with the use cases here. Even with this patch there is still the need to write a wrapper to get the functionality that one would expect to just be possible by setting inheritable bits on a file. The necessity to set the bits via prctl in the wrapper complicates matters further and makes it even more difficult than we thought before to make use of this feature. > http://ols.fedoraproject.org/OLS/Reprints-2008/hallyn-reprint.pdf Well maybe one should make sure that this info is properly comunicated in the man pages and related documentation? This seems to be a big decade old desaster. I need a Ph.D. in capabilities in order to attempt to use them (but then oww no they still are not able to handle my use cases). We get security through obscurity and also have then the inabilty to make effective use of capabilities? Security measures need to follow basic conventions, be obvious and easily understandable as well as well documented. There is a huge risk of a sysadmin misconfiguring one of the multiple measures that one needs to go through in order to gain some sort of inheritance of capabilities and thereby adding more functionality than necessary just in order to get it to work. The best measure would be to make the inheritance bits work as one would naturally expect. They just allow full inheritance of the caps. No wrappers needed and its easily understood what it does.