linux-kernel - proposal to refine capability checks when _rlimit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1a8ed7bd.c96e.18ccd4ee4d1.Coremail.mengjingzi@iie.ac.cn>
Date: Wed, 3 Jan 2024 11:12:28 +0800 (GMT+08:00)
From: 孟敬姿 <mengjingzi@....ac.cn>
To: brauner@...nel.org
Cc: linux-kernel@...r.kernel.org, bpf@...r.kernel.org
Subject: proposal to refine capability checks when _rlimit_overlimit() is
 true

Hi!

We observed a potential refinement in the kernel/fork.c line 2368. Currently, both CAP_SYS_ADMIN and CAP_SYS_RESOURCE are checked when the limit is over system limit. We suggest considering an adjustment to utilize CAP_SYS_RESOURCE exclusively. Here's our rationale for this suggestion:

(1) Defined Capability for Resource Access: According to the capability manual page[1], the capability explicitly defined for bypassing resource limits is CAP_SYS_RESOURCE. This capability is designed to provide the necessary privileges for accessing system resources without over-privileging with the broader CAP_SYS_ADMIN.

(2) Maintaining Least Privilege: CAP_SYS_ASMIN is already overloaded and known as the new "root"[2]. The use of CAP_SYS_ADMIN in this context might inadvertently over-privilege the system by providing more capabilities than necessary. And according to capability manual page[1], “Don't choose CAP_SYS_ADMIN if you can possibly avoid it!”, it's beneficial to use the most specific capability required for a given task.

This issue exists in several kernel versions and we have checked it on the latest stable release(Linux 6.6.9).

Your insights and feedback on this proposed modification would be highly appreciated. Thank you for your time and consideration.

Best regards,
Jingzi

reference:
[1] https://www.man7.org/linux/man-pages/man7/capabilities.7.html
[2] https://lwn.net/Articles/486306/