linux-hardening - Suggestion for Capability Check Refinement in check_syslog

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1ee10aa6.d064.18ccdb23971.Coremail.mengjingzi@iie.ac.cn>
Date: Wed, 3 Jan 2024 13:00:58 +0800 (GMT+08:00)
From: 孟敬姿 <mengjingzi@....ac.cn>
To: pmladek@...e.com, rostedt@...dmis.org, john.ogness@...utronix.de, 
	senozhatsky@...omium.org, keescook@...omium.org, tony.luck@...el.com, 
	gpiccoli@...lia.com
Cc: linux-hardening@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Suggestion for Capability Check Refinement in
 check_syslog_permissions()

Hi, we suggest revisiting the capability checks in check_syslog_permissions(). Currently CAP_SYSLOG is checked first, and if it’s not there but there is a CAP_SYS_ADMIN, it can also pass the check. We recommend refining this check to exclusively use CAP_SYSLOG. Here's our reasoning for this suggestion:

(1) Independence of CAP_SYSLOG and CAP_SYS_ADMIN: Since the introduction of CAP_SYSLOG in Linux 2.6.37, it has been a distinct capability from CAP_SYS_ADMIN. For compatibility reasons, it might make sense to keep CAP_SYS_ADMIN at the beginning. However, now that 13 years have passed，we think maybe it's appropriate to update the code to reflect their separate roles. 

(2) Maintaining Least Privilege Principle: CAP_SYS_ADMIN is overloaded and known as the new "root"[1]. And according to the manual page[2] “Don't choose CAP_SYS_ADMIN if you can possibly avoid it!”, it's beneficial to use the most specific capability required for a given task.

This issue exists in several kernel versions and we have checked it on the latest stable release(Linux 6.6.9). 

Your feedback and insights on this proposed modification would be highly appreciated. Thank you for your time and consideration.

Best regards,
Jingzi

reference:
[1] https://lwn.net/Articles/486306/
[2] https://www.man7.org/linux/man-pages/man7/capabilities.7.html