lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <1ee10aa6.d064.18ccdb23971.Coremail.mengjingzi@iie.ac.cn>
Date: Wed, 3 Jan 2024 13:00:58 +0800 (GMT+08:00)
From: 孟敬姿 <mengjingzi@....ac.cn>
To: pmladek@...e.com, rostedt@...dmis.org, john.ogness@...utronix.de, 
	senozhatsky@...omium.org, keescook@...omium.org, tony.luck@...el.com, 
	gpiccoli@...lia.com
Cc: linux-hardening@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Suggestion for Capability Check Refinement in
 check_syslog_permissions()

Hi, we suggest revisiting the capability checks in check_syslog_permissions(). Currently CAP_SYSLOG is checked first, and if it’s not there but there is a CAP_SYS_ADMIN, it can also pass the check. We recommend refining this check to exclusively use CAP_SYSLOG. Here's our reasoning for this suggestion:

(1) Independence of CAP_SYSLOG and CAP_SYS_ADMIN: Since the introduction of CAP_SYSLOG in Linux 2.6.37, it has been a distinct capability from CAP_SYS_ADMIN. For compatibility reasons, it might make sense to keep CAP_SYS_ADMIN at the beginning. However, now that 13 years have passed,we think maybe it's appropriate to update the code to reflect their separate roles. 

(2) Maintaining Least Privilege Principle: CAP_SYS_ADMIN is overloaded and known as the new "root"[1]. And according to the manual page[2] “Don't choose CAP_SYS_ADMIN if you can possibly avoid it!”, it's beneficial to use the most specific capability required for a given task.

This issue exists in several kernel versions and we have checked it on the latest stable release(Linux 6.6.9). 

Your feedback and insights on this proposed modification would be highly appreciated. Thank you for your time and consideration.

Best regards,
Jingzi

reference:
[1] https://lwn.net/Articles/486306/
[2] https://www.man7.org/linux/man-pages/man7/capabilities.7.html

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ