linux-kernel - Re: [RFC] Implement ambient capability set.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 4 Feb 2015 16:01:05 -0600 (CST)
From:	Christoph Lameter <cl@...ux.com>
To:	Andy Lutomirski <luto@...capital.net>
cc:	"Serge E. Hallyn" <serge@...lyn.com>,
	"Andrew G. Morgan" <morgan@...nel.org>,
	Serge Hallyn <serge.hallyn@...ntu.com>,
	Serge Hallyn <serge.hallyn@...onical.com>,
	Jonathan Corbet <corbet@....net>,
	Aaron Jones <aaronmdjones@...il.com>, Ted Ts'o <tytso@....edu>,
	LSM List <linux-security-module@...r.kernel.org>,
	lkml <linux-kernel@...r.kernel.org>,
	Andrew Morton <akpm@...uxfoundation.org>
Subject: Re: [RFC] Implement ambient capability set.

On Wed, 4 Feb 2015, Andy Lutomirski wrote:

> >> Christoph, would your code run ok under NNP?
> >
> > There are still binaries invoked that need more priviledges. Does not
> > work.
>
> What do you mean by "need more privileges"?  Are they setuid-root or
> do they use fP?

Both.

> > Well I'd rather have a way to avoid writing a tool. The best would be if
> > you could just set some caps and that would do it.
>
> However this ends up working, I'll add support to setpriv for it, so
> you'll be spared writing the tool if that's acceptable. :)

Sure.

> >                 __u32 inheritable = caps->inheritable.cap[i];
> >
> >                 /*
> > -                * pP' = (X & fP) | (pI & fI)
> > +                * pP' = (fA & fP) | (X & fP) | (pI & fI)
>
> pA & pP?

Ok.

> > +               else if (rc != -ENODATA)
> > +                       goto out;
> > +               rc = 0;
> > +               if (!cap_isclear(current_cred()->cap_ambient))
> > +                       goto out;
>
> Confused.  What about effective?  Don't we still need to address that?

Seems that the caps do not take effect unless I set them. Is there a
better way to do this? Logic is wrong. It must be

if (cap_isclear(..)) goto out


> > +                       return -EPERM;
>
> I don't see why this is necessary given the change above.

I guess I should repost the whole patch.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/