Message-ID: <50C2209E.7060306@schaufler-ca.com>
Date:	Fri, 07 Dec 2012 09:00:14 -0800
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	"Serge E. Hallyn" <serge@...lyn.com>
CC:	Serge Hallyn <serge.hallyn@...onical.com>,
	Andy Lutomirski <luto@...capital.net>,
	"Andrew G. Morgan" <morgan@...nel.org>,
	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	Kees Cook <keescook@...omium.org>,
	James Morris <james.l.morris@...cle.com>,
	Eric Paris <eparis@...hat.com>,
	"Serge E. Hallyn" <serge@...onical.com>,
	Markku Savela <msa@...h.iki.fi>,
	Casey Schaufler <casey@...aufler-ca.com>
Subject: Re: [RFC] Capabilities still can't be inherited by normal programs

On 12/7/2012 6:42 AM, Serge E. Hallyn wrote:
> Quoting Casey Schaufler (casey@...aufler-ca.com):
>> On 12/5/2012 2:20 PM, Serge Hallyn wrote:
>>> Quoting Andy Lutomirski (luto@...capital.net):
>>>> On Wed, Dec 5, 2012 at 1:05 PM, Serge Hallyn <serge.hallyn@...onical.com> wrote:
>>>>> Quoting Andy Lutomirski (luto@...capital.net):
>>>>>> On Tue, Dec 4, 2012 at 5:54 AM, Serge E. Hallyn <serge@...lyn.com> wrote:
>>>>>>> Quoting Andy Lutomirski (luto@...capital.net):
>>>>>>>>>> d) If I really wanted, I could emulate execve without actually doing
>>>>>>>>>> execve, and capabilities would be inherited.
>>>>>>>>> If you could modify the executable properties of the binary that has
>>>>>>>>> the privilege to wield a privilege then you are either exploiting an
>>>>>>>>> app bug, or doing something the privileged binary has been trusted to
>>>>>>>>> do.
>>>>>>>> That's not what I mean.  I would:
>>>>>>>>
>>>>>>>> fork()
>>>>>>>> munmap everything
>>>>>>>> mmap ld.so
>>>>>>>> set up a fake initial stack and the right fd or mapping or whatever
>>>>>>>> just to ld-linux.so
>>>>>>>>
>>>>>>>> That's almost execve, and privilege inheritance works.
>>>>>>> But of course that is why you only want to fill fI on programs you trust
>>>>>>> not to do that.  What you are arguing is that you want to give fI on
>>>>>>> programs you don't trust anyway, and so heck why not just give it on
>>>>>>> everything.
>>>>>>>
>>>>>> Huh?  I'd set fP on a program I expect to do *exactly* that (or use
>>>>>> actual in-kernel capability inheritance, which I would find vastly
>>>>>> more pleasant).  If I give a program a capability (via fP or fI & pI),
>>>>>> then I had better trust it not to abuse that capability.  Having it
>>>>>> pass that capability on to a child helper process would be just fine
>>>>>> with me *because it already has that capability*.
>>>>>>
>>>>>> The problem with the current inheritance mechanism is that it's very
>>>>>> difficult to understand what it means for an fI bit or a pI bit to be
>>>>>> set.  Saying "set a pI bit using pam if you want to grant permission
>>>>>> to that user to run a particular program with fI set" is crap -- it
>>>>>> only works if there is exactly one binary on the system with that bit
>>>>>> set.  In any case, a different administrator or package might use it
>>>>>> for something different.
>>>>>>
>>>>>> Suppose I use the (apparently) current suggested approach: I install a
>>>>>> fI=cap_net_raw copy of tcpdump somewhere.  Then I write a helper that
>>>>>> has fP=cap_new_raw and invokes that copy of tcpdump after appropriate
>>>>>> validation of parameters.  All is well.
>>>>> Since you're writing a special helper, you can surely have it validate
>>>>> the userid and make it so the calling user doesn't have to have
>>>>> cap_net_raw in pI?
>>>> I can and did.
>>> Oh, oops, I mis-understood what you meant was the problem.
>>>
>>> Yup, that is a real limitation.
>>>
>>> Yes, with the posix file caps you will be disappointed unless you see
>>> pI=X as "this user may run any program which is Inh-trusted with X" and
>>> fI=X as "this program may be run with X by any user Inh-trusted with X".
>>>
>>> It almost makes me want to say that there should be an execve-analogue
>>> to prctl(PR_SET_KEEPCAPS), which says caps will remain unchanged for one
>>> execve.  Or perhaps an intermediate securebits state between
>>> !SECBIT_NOROOT and SECBIT_NOROOT, which automatically transitions after
>>> the first execve to SECBIT_NOROOT.
>>>
>>>> The mere presence of a cap_net_raw+i tcpdump binary is more or less
>>>> equivalent to saying that users with cap_net_raw in pI can capture
>>>> packets.  I've just prevented pI=cap_net_raw from meaning anything
>>>> less than "can capture packets".  So I think we should bite the bullet
>>>> and just let programs opt in (via some appropriately careful
>>>> mechanism) to real capability inheritance.
>>> By real you mean more precise.  I think it'd be very interesting to get
>>> together with Markku and learn more from the N9 experiment!
>>>
>>> Markku, are there any post-mortem analysis papers we can read for
>>> starters?  Andy would not be trying to restrict root in general, so
>>> the ramification you cited may not necessarily be relevant.
>>>
>>> -serge
>> http://wt.tuxomania.net/publications/posix.1e/download.html
>>
>> Everyone should read the capabilities rationale. It answers most
>> of the questions on this thread, and a bunch more. The capabilities
>> mechanism has to support what are currently setuid-root programs
>> without change and allow for new programs that use the mechanism
>> wisely and fully.
> How to put this delicately...   that is not enjoyable reading :)

It wasn't enjoyable writing, either! And the comment resolution
process was ... long.

> As I understood it, the draft supports setuid-root programs, but
> does not support a !SECBIT_NOROOT environment.  If that is not the
> case, can you point to where in the draft that is described?

The draft describes interfaces, not systems. This was how POSIX was
set up, and specific use cases were explicitly beyond the scope of
the document. The committee represented a number of vendors and the
various uses were discussed, but by rule could not go into the document.

So you're correct, the draft does not address the issue directly.
It appeared that some of the arguments being made included assumptions
about the behavior and derivation of Linux capabilities that were
not accurate. I hope that providing the link helps some of the people
who are unfamiliar with that.


>
> Regardless,
>
> 1. Andy describes a problem which AFAICT can't be solved with the
> current capabilities support.  An intermediate state between
> !SECBIT_NOROOT and SECBIT_NOROOT (which itself is IIUC already an
> extension beyond the above draft) seems an interesting feature to
> consider which would support the wrapper case - but not something
> to run into blindly without considering all the ramifications.
>
> 2. The N9 folks have experimented with other inheritence properties,
> and the details their experience would be educational.
>
> There are two other ways the wrappered privileged tcpdump could be
> achieved:
>
> 1. Have the privileged wrapper create a new user and network
> namespace and pass the network device into the new network
> namespace and run tcpdump there with privilege.  This doesn't
> work if the specific device also needs to be used in the original
> network namespace (but passing a device bridged with the one of
> interest might suffice?).
>
> 2. Have the privileged wrapper create a small tmpfs mount in a
> (non-ms-shared) new mounts namespace, copy tcpdump into that mount
> and give it fI=CAP_NET_RAW, then execute the child with
> pI=CAP_NET_RAW.  A bit hacky, but prevents the issue of other
> users with pI=CAP_NET_RAW from executing that tcpdump.  Since
> the child will have pP=CAP_NET_RAW, the other users should be
> prevented from getting to the modified tcpdump binary through
> the child's /proc/pid/fd/N.
>
> Not saying these are ideal, just trying to think of ways of
> solving the problem...
>
> -serge
>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists