linux-kernel - Re: [patch] file capabilities: Add no_file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 27 Aug 2008 17:29:18 +0200
From:	Andreas Gruenbacher <agruen@...e.de>
To:	"Serge E. Hallyn" <serue@...ibm.com>
Cc:	"Andrew G. Morgan" <morgan@...nel.org>,
	linux-kernel@...r.kernel.org
Subject: Re: [patch] file capabilities: Add no_file_caps switch

On Wednesday, 27 August 2008 15:52:06 Serge E. Hallyn wrote:
> Quoting Andreas Gruenbacher (agruen@...e.de):
> > Hello,
> >
> > here is a patch allowing to disable file capabilities via a kernel
> > command line option (once compiled in with
> > CONFIG_SECURITY_FILE_CAPABILITIES).
> >
> > We would like to ship our next round of products with file capabilities
> > compiled in, yet we feel that too many system utilities are still file
> > capabilitiy unaware, and so we would like to turn them off by default
> > initially. File capabilities can be used to grant privileges to binaries
> > which otherwise look "harmless", which is a security risk until utilities
> > like rpm have learned how to install and verify capabilities, etc.
> >
> > Any objections?
>
> Hi Andreas,
>
> No objections in general - if it makes you more comfortable shipping
> kernels with CONFIG_SECURITY_FILE_CAPABILITIES=y then it's worthwhile.
> However, can you elaborate on your concerns?

We don't have the time left for developing the few missing pieces and properly 
integrating file capabilities into our products (use in various packages, 
support in rpm, system management, manuals, release notes), and so I would 
like to have a way to turn them off by default for now.

> In particular, if as you say above the concern is really just that a
> file might have capabilities accidentally (or maliciously) enabled, then
> we should be able to just check for file_caps_enabled() at
> get_file_caps(), refusing to fill in the file capabilities.

My main concern is accidental granting of capabilities because of admin 
unawareness / lack of tool support. This could be taken care of by not 
loading the capabilities from disk.

> The other changes which you are canceling out confuscate the code but
> actually make no difference.

Well, the other difference is that with CONFIG_SECURITY_FILE_CAPABILITIES=y 
you currently lose the ability to pass on capabilities to other processes. Do 
you have good arguments why this feature is unnecessary? I don' think that 
having this feature was a good idea in the first place, but taking it away 
now after several years may break current users which may not have gotten 
converted, yet.

Thanks,
Andreas
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/