linux-kernel - Re: [RFC][7/11][MANUX] Kernel compatibility : capset(2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140415161049.721f44c1@alan.etchedpixels.co.uk>
Date:	Tue, 15 Apr 2014 16:10:49 +0100
From:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
To:	Emmanuel Colbus <ecolbus@...ux.info>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: [RFC][7/11][MANUX] Kernel compatibility : capset(2)

> Also, for your information, I decided to use 64-bit capabilities, in
> order to give a possibility to reduce the rights of an unprivileged
> software (for example, if a process lacks CAP_USR_CHMOD, it won't be
> able to perform a chmod on an existing file). This means I'm not using
> the same data structure as you; do you have any objection to it?

Save yourself the effort. The Linux old style capble() model is basically
broken. It's vaguely useful if you combine it with SELinux to repair some
of the awkward cases.

The world has moved on to MAC/DAC and is heading now for real
"capability" based security which is nothing to do with having a bunch of
bit flags.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/