lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <1a8ed7bd.c96e.18ccd4ee4d1.Coremail.mengjingzi@iie.ac.cn>
Date: Wed, 3 Jan 2024 11:12:28 +0800 (GMT+08:00)
From: 孟敬姿 <mengjingzi@....ac.cn>
To: brauner@...nel.org
Cc: linux-kernel@...r.kernel.org, bpf@...r.kernel.org
Subject: proposal to refine capability checks when _rlimit_overlimit() is
 true

Hi!

We observed a potential refinement in the kernel/fork.c line 2368. Currently, both CAP_SYS_ADMIN and CAP_SYS_RESOURCE are checked when the limit is over system limit. We suggest considering an adjustment to utilize CAP_SYS_RESOURCE exclusively. Here's our rationale for this suggestion:

(1) Defined Capability for Resource Access: According to the capability manual page[1], the capability explicitly defined for bypassing resource limits is CAP_SYS_RESOURCE. This capability is designed to provide the necessary privileges for accessing system resources without over-privileging with the broader CAP_SYS_ADMIN.

(2) Maintaining Least Privilege: CAP_SYS_ASMIN is already overloaded and known as the new "root"[2]. The use of CAP_SYS_ADMIN in this context might inadvertently over-privilege the system by providing more capabilities than necessary. And according to capability manual page[1], “Don't choose CAP_SYS_ADMIN if you can possibly avoid it!”, it's beneficial to use the most specific capability required for a given task.

This issue exists in several kernel versions and we have checked it on the latest stable release(Linux 6.6.9).

Your insights and feedback on this proposed modification would be highly appreciated. Thank you for your time and consideration.

Best regards,
Jingzi

reference:
[1] https://www.man7.org/linux/man-pages/man7/capabilities.7.html
[2] https://lwn.net/Articles/486306/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ