linux-kernel - Re: [PATCH] -mm (2.6.24-rc3-mm1) Smack using capabilities 32 and 33

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 25 Nov 2007 09:13:31 -0800 (PST)
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	Andrew Morgan <morgan@...nel.org>, casey@...aufler-ca.com
Cc:	akpm@...l.org, torvalds@...l.org, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org
Subject: Re: [PATCH] -mm (2.6.24-rc3-mm1) Smack using capabilities 32 and 33


--- Andrew Morgan <morgan@...nel.org> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> 
> Casey Schaufler wrote:
> > diff -uprN -X linux-2.6.24-rc3-mm1-base/Documentation/dontdiff
> linux-2.6.24-rc3-mm1-base/include/linux/capability.h
> linux-2.6.24-rc3-mm1-smack/include/linux/capability.h
> > --- linux-2.6.24-rc3-mm1-base/include/linux/capability.h	2007-11-22
> 01:51:36.000000000 -0800
> > +++ linux-2.6.24-rc3-mm1-smack/include/linux/capability.h	2007-11-24
> 11:26:51.000000000 -0800
> > @@ -314,6 +314,23 @@ typedef struct kernel_cap_struct {
> >  
> >  #define CAP_SETFCAP	     31
> >  
> > +/* Override MAC access.
> > +   The base kernel enforces no MAC policy.
> > +   An LSM may enforce a MAC policy, and if it does and it chooses
> > +   to implement capability based overrides of that policy, this is
> > +   the capability it should use to do so. */
> > +
> > +#define CAP_MAC_OVERRIDE     32
> > +
> > +/* Allow MAC configuration or state changes.
> > +   The base kernel requires no MAC configuration.
> > +   An LSM may enforce a MAC policy, and if it does and it chooses
> > +   to implement capability based checks on modifications to that
> > +   policy or the data required to maintain it, this is the
> > +   capability it should use to do so. */
> > +
> > +#define CAP_MAC_ADMIN        33
> > +
> >  /*
> >   * Bit location of each capability (used by user-space library and kernel)
> >   */
> > @@ -334,7 +351,8 @@ typedef struct kernel_cap_struct {
> >  			    | CAP_TO_MASK(CAP_DAC_OVERRIDE)	\
> >  			    | CAP_TO_MASK(CAP_DAC_READ_SEARCH)	\
> >  			    | CAP_TO_MASK(CAP_FOWNER)		\
> > -			    | CAP_TO_MASK(CAP_FSETID))
> > +			    | CAP_TO_MASK(CAP_FSETID) \
> 
> The following looks a bit fishy:
> > +			    | CAP_TO_MASK(CAP_MAC_OVERRIDE))
> 
>   (1<<32) & 0xffffffff == 0
> 
> I think you need to define CAP_FS_MASK_B1.

I think you're right, and I'll need to use it, too.


Casey Schaufler
casey@...aufler-ca.com
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/