linux-kernel - Re: [RFC] Capabilities still can't be inherited by normal programs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20121204135445.GA7420@mail.hallyn.com>
Date:	Tue, 4 Dec 2012 13:54:45 +0000
From:	"Serge E. Hallyn" <serge@...lyn.com>
To:	Andy Lutomirski <luto@...capital.net>
Cc:	"Andrew G. Morgan" <morgan@...nel.org>,
	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	Kees Cook <keescook@...omium.org>,
	James Morris <james.l.morris@...cle.com>,
	Eric Paris <eparis@...hat.com>,
	"Serge E. Hallyn" <serge@...onical.com>
Subject: Re: [RFC] Capabilities still can't be inherited by normal programs

Quoting Andy Lutomirski (luto@...capital.net):
> >> d) If I really wanted, I could emulate execve without actually doing
> >> execve, and capabilities would be inherited.
> >
> > If you could modify the executable properties of the binary that has
> > the privilege to wield a privilege then you are either exploiting an
> > app bug, or doing something the privileged binary has been trusted to
> > do.
> 
> That's not what I mean.  I would:
> 
> fork()
> munmap everything
> mmap ld.so
> set up a fake initial stack and the right fd or mapping or whatever
> just to ld-linux.so
> 
> That's almost execve, and privilege inheritance works.

But of course that is why you only want to fill fI on programs you trust
not to do that.  What you are arguing is that you want to give fI on
programs you don't trust anyway, and so heck why not just give it on
everything.

Anyway, implementing the features you want in a new module is encouraged,
so long as the behavior of existing module stays the same.

-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/