linux-kernel - Re: [PATCH 1/1] file capabilities: introduce cap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 28 Jun 2007 10:33:18 +0900
From:	KaiGai Kohei <kaigai@...jp.nec.com>
To:	"Serge E. Hallyn" <serue@...ibm.com>
CC:	Andrew Morgan <morgan@...nel.org>,
	Chris Wright <chrisw@...s-sol.org>,
	Andrew Morgan <agm@...gle.com>, casey@...aufler-ca.com,
	Andrew Morton <akpm@...gle.com>,
	Stephen Smalley <sds@...ho.nsa.gov>,
	KaiGai Kohei <kaigai@...gai.gr.jp>,
	James Morris <jmorris@...ei.org>,
	linux-security-module@...r.kernel.org,
	lkml <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/1] file capabilities: introduce cap_setfcap

Serge E. Hallyn wrote:
> Here's the first patch (of several or many to come) to address some of
> Andrew's comments.
> 
> Kaigai, IIUC cap_names.h will eventually be automatically updated?  (I
> had to manually tweak it for testing as the new kernel sources were not
> located on the test system)

The origin of cap_names.h is "/usr/include/linux/capability.h".
Some scripts kicked by Makefile convert it, then cap_names.h will
be generated.

I don't know whether we can expect the kernel headers are always
deployed under "/usr/include/linux", or not.
In Fedora system, the kernel-headers package deploys all headers
there, so cap_names.h will eventually be automatically updated.

Thanks,

> thanks,
> -serge
> 
>>>From fefcd341e478bd9e490d34abe9efd3c3c4f0b8a0 Mon Sep 17 00:00:00 2001
> From: Serge E. Hallyn <serue@...ibm.com>
> Date: Wed, 27 Jun 2007 13:09:20 -0400
> Subject: [PATCH 1/1] file capabilities: introduce cap_setfcap
> 
> Setting file capabilities previously required the
> cap_sys_admin capability, since they are stored as
> extended attributes in the security.* namespace.
> 
> Introduce CAP_SETFCAP (to mirror CAP_SETPCAP), and
> require it for setting file capabilities instead of
> CAP_SYS_ADMIN.
> 
> Quoting Andrew Morgan,
> 
> "CAP_SYS_ADMIN is way too overloaded and this
> functionality is special."
> 
> Signed-off-by: Serge E. Hallyn <serue@...ibm.com>
> ---
>  include/linux/capability.h |    4 +++-
>  security/commoncap.c       |   12 ++++++++++--
>  2 files changed, 13 insertions(+), 3 deletions(-)
> 
> diff --git a/include/linux/capability.h b/include/linux/capability.h
> index 89125df..cdfaa10 100644
> --- a/include/linux/capability.h
> +++ b/include/linux/capability.h
> @@ -324,7 +324,9 @@ typedef __u32 kernel_cap_t;
>  
>  #define CAP_AUDIT_CONTROL    30
>  
> -#define CAP_NUMCAPS	     31
> +#define CAP_SETFCAP	     31
> +
> +#define CAP_NUMCAPS	     32
>  
>  #ifdef __KERNEL__
>  /* 
> diff --git a/security/commoncap.c b/security/commoncap.c
> index 4e9ff02..24de4fa 100644
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -290,7 +290,11 @@ int cap_bprm_secureexec (struct linux_binprm *bprm)
>  int cap_inode_setxattr(struct dentry *dentry, char *name, void *value,
>  		       size_t size, int flags)
>  {
> -	if (!strncmp(name, XATTR_SECURITY_PREFIX,
> +	if (!strcmp(name, XATTR_NAME_CAPS)) {
> +		if (!capable(CAP_SETFCAP))
> +			return -EPERM;
> +		return 0;
> +	} else if (!strncmp(name, XATTR_SECURITY_PREFIX,
>  		     sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
>  	    !capable(CAP_SYS_ADMIN))
>  		return -EPERM;
> @@ -299,7 +303,11 @@ int cap_inode_setxattr(struct dentry *dentry, char *name, void *value,
>  
>  int cap_inode_removexattr(struct dentry *dentry, char *name)
>  {
> -	if (!strncmp(name, XATTR_SECURITY_PREFIX,
> +	if (!strcmp(name, XATTR_NAME_CAPS)) {
> +		if (!capable(CAP_SETFCAP))
> +			return -EPERM;
> +		return 0;
> +	} else if (!strncmp(name, XATTR_SECURITY_PREFIX,
>  		     sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
>  	    !capable(CAP_SYS_ADMIN))
>  		return -EPERM;


-- 
Open Source Software Promotion Center, NEC
KaiGai Kohei <kaigai@...jp.nec.com>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/