linux-kernel - Suggestion for the capability check in aac_send_raw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <363710f0.c0f9.18ccd026bda.Coremail.mengjingzi@iie.ac.cn>
Date: Wed, 3 Jan 2024 09:48:57 +0800 (GMT+08:00)
From: 孟敬姿 <mengjingzi@....ac.cn>
To: aacraid@...rosemi.com, jejb@...ux.ibm.com, martin.petersen@...cle.com
Cc: linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Suggestion for the capability check in aac_send_raw_srb()

Hi!

We noticed a potential refinement in the aac_send_raw_srb() function, the CAP_SYS_ADMIN is checked at the beginning of the function and we believe it is better to use CAP_SYS_RAWIO instead. Here are the reasons for this recommendation:

(1) Purpose of Capability Check: The error message when CAP_SYS_ADMIN check fails indicates that the capability check is intended to protect the subsequent send operations, including acc_hba_send() and acc_fib_send(). Given that these functions are used for sending SCSI commands, the more appropriate capability, as per the capability manual page[1], is CAP_SYS_RAWIO ("perform various SCSI device commands").

(2) Consistency with Address Mapping: The function aac_send_raw_srb() also calls dma_map_single() for address mapping. In a similar context in drivers/scsi/hpsa.c, the mapping function is protected by CAP_SYS_RAWIO. Consistency in the use of capabilities enhances code clarity and maintains a standardized approach.

(3) Maintaining Least Privilege: CAP_SYS_ASMIN is already overloaded and known as the new "root"[2], and according to the manual page[1] “don't choose CAP_SYS_ADMIN if you can possibly avoid it”,  we believe that utilizing the more specific CAP_SYS_RAWIO is in line with the principle of least privilege and contributes to a more secure codebase.

This issue exists in several kernel versions and we have checked it on the latest stable release(Linux 6.6.9)

We would appreciate your insights and feedback on this proposal. Thank you for your time and consideration.

Best regards,
Jingzi

reference:
[1] https://www.man7.org/linux/man-pages/man7/capabilities.7.html
[2] https://lwn.net/Articles/486306/