linux-kernel - Re: Frustrated with capabilities..

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080828174854.GM26987@mit.edu>
Date:	Thu, 28 Aug 2008 13:48:54 -0400
From:	Theodore Tso <tytso@....edu>
To:	Markku Savela <msa@...h.iki.fi>
Cc:	Pavel Machek <pavel@...e.cz>, linux-kernel@...r.kernel.org
Subject: Re: Frustrated with capabilities..

On Thu, Aug 28, 2008 at 05:45:34PM +0300, Markku Savela wrote:
> 
> > From: Pavel Machek <pavel@...e.cz>
> 
> > Yes, you need upcoming filesystem capabilities.  Binary may not
> > inherit capabilities unless filesystem flags permit that.
> 
> I think this is wrong. Normal executables inherit uid/gid and
> supplementary groups by default. Why should capabilities be any
> different?

Well, because that's not the what the POSIX draft specification (and
the rest of the Unix industry who were striving to meet the US
Department of Defense's "B2 by '92" initiative) ended up implementing.

The reason for that was to avoid bugs where a program that wasn't
expecting to be setuid (or just written by a stupid progammer) exec's
some program which wasn't expecting to have root privileges then bad
things happen.  The classic example of this was running the mail
program, which was setuid or setgid to the mail user/group, and then
typing "!/bin/sh" which would exec a shell running with those
privileges (because the mail program didn't know to drop its
privileges).

So in the capabilities model, the capabilities do *not* inherit unless
the a particular file explicitly states that it should inherit the
capabilities.  It's the principle of least privilege taken to its
logical conclusion.

						- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/