netdev - Suggestion for Capability Check Refinement in too_many_unix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 3 Jan 2024 11:24:19 +0800 (GMT+08:00)
From: 孟敬姿 <mengjingzi@....ac.cn>
To: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, 
	pabeni@...hat.com
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Suggestion for Capability Check Refinement in too_many_unix_fds()

Hi!

We identified a potential refinement in the too_many_unix_fds() function. Currently CAP_SYS_ADMIN and CAP_SYS_RESOURCE are checked when the number of open files in a socket exceeds the upper limit, having either one could pass the check. We recommend revisiting the capability checks and considering to utilize CAP_SYS_RESOURCE exclusively. Here's our rationale for this suggestion:

(1) Defined Capability for Resource Limits: According to the capability manual page[1], the capability explicitly designed for bypassing system resource limits is CAP_SYS_RESOURCE(CAP_SYS_RESOURCE: allow the RLIMIT_NOFILE resource limit on the number of "in-flight" file descriptors to be bypassed).

(2) Preserving Least Privilege Principle: CAP_SYS_ADMIN check in this context may lead to over-privileging. It is already overloaded and known as the new "root"[2]. According to the manual page[1] “Don't choose CAP_SYS_ADMIN if you can possibly avoid it!”, it's beneficial to use the most specific capability required for a given task.

This issue exists in several kernel versions and we have checked it on the latest stable release(Linux 6.6.9). 

Your feedback and insights on this proposed modification would be greatly appreciated. Thank you for your time and consideration.

Best regards,
Jingzi

reference:
[1] https://www.man7.org/linux/man-pages/man7/capabilities.7.html
[2] https://lwn.net/Articles/486306/