linux-kernel - Re: File capabilities are not 'working' and I have no idea why

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 26 Jan 2014 17:22:28 +0100
From:	"Serge E. Hallyn" <serge@...lyn.com>
To:	Aaron Jones <aaronmdjones@...il.com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: File capabilities are not 'working' and I have no idea why

Quoting Aaron Jones (aaronmdjones@...il.com):
> 
> Hello.
> 
> I recently upgraded from 3.10.7 on a long-running box to 3.12.8 on a
> new box. I have been using file capabilities for a long time, so that
> processes do not need to start as root and drop unnecessary privileges
> later.
> 
> For example, there is no reason for my bind9 nameservers to start as
> root, except to bind() port 53 and 953. What I did in this case was to
> chown it to root:named and chmod it to 0750 and assign
> CAP_NET_BIND_SERVICE to it, it then starts as named and works fine.
> 
> I haven't had any issues with this for easily a year, until now. No
> matter what I do on this new machine, I cannot get file capabilities
> to 'work'. They are set fine, they are read back fine, but they don't
> do anything. I have attached my kernel boot log, its configuration and
> a test program (build with -std=c99 -lcap-ng).
> 
> My problem follows:
> 
> # strace -f setcap cap_net_bind_service+eip /usr/local/bin/caps 2>&1 \
>   | grep xattr
>  setxattr("/usr/local/bin/caps", "security.capability", \
>   "\x01\x00\x00\x02\x00\x04\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00 \
>    \x00\x00\x00\x00", 20, 0) = 0
> 
> # getcap /usr/local/bin/caps
> /usr/local/bin/caps = cap_net_bind_service+eip
> 
> $ /usr/local/bin/caps
> Effective capabilities: (none)
> Permitted capabilities: (none)

Hm, I'm running Ubuntu 3.13.0-5-generic and I do get

serge@tp:~/test$ ./caps
Effective capabilities:
net_bind_service

Permitted capabilities:
net_bind_service

Any chance (grasping for straws here) that the hardening patches are
interfering?  Can you try hand-building an upstream kernel to test
with?

-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/