linux-kernel - Re: [capabilities] Allow normal inheritance for a configurable set of capabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 02 Feb 2015 12:35:18 -0800
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	Austin S Hemmelgarn <ahferroin7@...il.com>,
	Mimi Zohar <zohar@...ux.vnet.ibm.com>,
	Serge Hallyn <serge.hallyn@...ntu.com>
CC:	Christoph Lameter <cl@...ux.com>,
	Serge Hallyn <serge.hallyn@...onical.com>,
	Andy Lutomirski <luto@...capital.net>,
	Jonathan Corbet <corbet@....net>,
	Aaron Jones <aaronmdjones@...il.com>, Ted Ts'o <tytso@....edu>,
	linux-security-module@...r.kernel.org,
	linux-kernel@...r.kernel.org, akpm@...uxfoundation.org,
	Casey Schaufler <casey@...aufler-ca.com>
Subject: Re: [capabilities] Allow normal inheritance for a configurable set
 of capabilities

On 2/2/2015 11:05 AM, Austin S Hemmelgarn wrote:
> On 2015-02-02 13:47, Mimi Zohar wrote:
>> On Mon, 2015-02-02 at 18:08 +0000, Serge Hallyn wrote:
>>> Quoting Casey Schaufler (casey@...aufler-ca.com):
>>>> I'm game to participate in such an effort. The POSIX scheme
>>>> is workable, but given that it's 20 years old and hasn't
>>>> developed real traction it's hard to call it successful.
>>>
>>> Over the years we've several times discussed possible reasons for this
>>> and how to help.  I personally think it's two things:  1. lack of
>>> toolchain and fs support.  The fact that we cannot to this day enable
>>> ping using capabilities by default because of cpio, tar and non-xattr
>>> filesystems is disheartening.
>>
>> We're working on resolving the CPIO issue.  tar currently supports
>> xattrs.  At this point, how many non-xattr filesystems are there really?
>>
>
> FAT*, and UFS immediately come to mind, and I know of people who use
> UFS for their root filesystem.  There are a handful (ext* included)
> that need an option turned on in the kernel config, and possibly also
> a mount option added.
>
> IIRC, the Linux NFS client has no xattr support, and that is very
> widely used because it's easier to set up than any alternatives.

There is NFSv4 support for Mandatory Access Control labels, but
so far it only works with SELinux contexts. It is not a general
solution. Networking people think poorly of the notion of extended
attributes over the wire.


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/