[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <82f874dc0cd580e12162b599f38d22ae8148620d.camel@linux.ibm.com>
Date: Thu, 02 Dec 2021 07:33:01 -0500
From: James Bottomley <jejb@...ux.ibm.com>
To: Denis Semakin <denis.semakin@...wei.com>,
Stefan Berger <stefanb@...ux.ibm.com>,
"linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>
Cc: "zohar@...ux.ibm.com" <zohar@...ux.ibm.com>,
"serge@...lyn.com" <serge@...lyn.com>,
"christian.brauner@...ntu.com" <christian.brauner@...ntu.com>,
"containers@...ts.linux.dev" <containers@...ts.linux.dev>,
"dmitry.kasatkin@...il.com" <dmitry.kasatkin@...il.com>,
"ebiederm@...ssion.com" <ebiederm@...ssion.com>,
Krzysztof Struczynski <krzysztof.struczynski@...wei.com>,
Roberto Sassu <roberto.sassu@...wei.com>,
"mpeters@...hat.com" <mpeters@...hat.com>,
"lhinds@...hat.com" <lhinds@...hat.com>,
"lsturman@...hat.com" <lsturman@...hat.com>,
"puiterwi@...hat.com" <puiterwi@...hat.com>,
"jamjoom@...ibm.com" <jamjoom@...ibm.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"paul@...l-moore.com" <paul@...l-moore.com>,
"rgb@...hat.com" <rgb@...hat.com>,
"linux-security-module@...r.kernel.org"
<linux-security-module@...r.kernel.org>,
"jmorris@...ei.org" <jmorris@...ei.org>
Subject: Re: [RFC 17/20] ima: Use integrity_admin_ns_capable() to check
corresponding capability
On Thu, 2021-12-02 at 07:16 +0000, Denis Semakin wrote:
> Obviously the main goal by adding new capability was to avoid the
> using CAP_SYS_ADMIN (IOW superuser)
OK, but as I've said a couple of times now: the check for CAP_SYS_ADMIN
doesn't have to be monolithic like this. We have two sets of checks in
the kernel: capable(..., CAP_SYS_ADMIN) which is for the global
monolithic root like capability and ns_capable(..., CAP_SYS_ADMIN)
which is for the owner (possibly unprivileged) of the user namespace.
This gives us a way of parsing out admin capabilites into the small
subset that the user namespace needs. Patch 16 changed the check from
capable to ns_capable, meaning it's no longer the monolithic
CAP_SYS_ADMIN.
> to manage IMA stuff, that was also about security granularity. It's
> good if CAP_MAC_ADMIN will be enough for doing IMA related things
> (write policies and extended attributes).
To be honest, as long as the check resolves to ns_capable(...,
CAP_SYS_<SOMETHING>) I'm not that bothered because the owner of the
user namespace will still pass the check.
> But for me it's a little bit unclear how to deal with unprivileged
> users: assuming there's no CAP_INTEGRITY_ADMIN but CAP_MAC_ADMIN was
> set up, so in this case user can control any LSM (seLinux, SMACK,
> etc) and IMA (policies, xattrs). What if .. for some systems there
> would be some requirements that will allow to touch LSM but do not
> change any IMA (integrity) things? A user can set up any IMA policy
> (it's about the system integrity), modify IMA related xattrs but it's
> forbidden to change seLinux policies and e.g. SMACK labels... May be
> it's unreal scenario of course... but I guess it's not 100%
> impossible.
This is why looking at it as a switch from capable to ns_capable is
useful: an ordinary user can assume ns_capable(..., CAP_SYS_ADMIN)
powers arbitrarily, so its a significant check on where you can make
the switch.
James
Powered by blists - more mailing lists