linux-kernel - Re: [RFC] Capabilities still can't be inherited by normal programs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20121210142757.GA8137@sergelap>
Date:	Mon, 10 Dec 2012 08:27:57 -0600
From:	Serge Hallyn <serge.hallyn@...onical.com>
To:	"Andrew G. Morgan" <morgan@...nel.org>
Cc:	"Serge E. Hallyn" <serge@...lyn.com>,
	Andy Lutomirski <luto@...capital.net>,
	"Serge E. Hallyn" <serge@...onical.com>,
	linux-security-module@...r.kernel.org,
	James Morris <james.l.morris@...cle.com>,
	Markku Savela <msa@...h.iki.fi>,
	Casey Schaufler <casey@...aufler-ca.com>,
	Eric Paris <eparis@...hat.com>,
	Kees Cook <keescook@...omium.org>, linux-kernel@...r.kernel.org
Subject: Re: [RFC] Capabilities still can't be inherited by normal programs

Quoting Andrew G. Morgan (morgan@...nel.org):
> I'm still missing something with the problem definition.
> 
> So far if I follow the discussion we have determined that inheritance as
> implemented is OK except for the fact that giving user an inheritable pI
> bit which gives them default permission to use all binaries endowed with
> the corresponding file fI bit.

There is another objection which ahs been raised, namely that it leaves too
many tiny but crucial bits of security relevant information spread throughout
the filesystem.

This has also been said about using security.selinux xattrs.  The answer as
there could be a good set of tools to set and report the system wide state.
In fact, libcap-ng provides such tools, to list the file capabilities
throughout the system and capabilities in use by all running programs.

-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/