netdev - Re: [PATCH] netlink: add send and receive capability requirement and capability flags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20130128.225524.472002600658532532.davem@davemloft.net>
Date:	Mon, 28 Jan 2013 22:55:24 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	rbriggs@...hat.com
Cc:	netdev@...r.kernel.org, rgb@...hat.com
Subject: Re: [PATCH] netlink: add send and receive capability requirement
 and capability flags

From: Richard Guy Briggs <rbriggs@...hat.com>
Date: Wed, 23 Jan 2013 09:52:24 -0500

> From: Richard Guy Briggs <rgb@...hat.com>
> 
> Currently netlink socket permissions are controlled by the
> NL_CFG_F_NONROOT_{RECV,SEND} flags in the kernel socket configuration or by the
> CAP_NET_ADMIN capability of the client.  The former allows non-root users
> access to the socket.  The latter allows all network admin clients access to
> the socket.  It would be useful to be able to further restrict this access to
> send or receive capabilities individually within specific subsystems with a
> more targetted capability.  Two more flags, NL_CFG_F_CAPABILITY_{RECV,SEND},
> have been added to specifically require a named capability should the subsystem
> request it, allowing the client to drop other broad unneeded capabilities.
> 
> Signed-off-by: Richard Guy Briggs <rbriggs@...hat.com>

I've been looking at this over and over again the past few days,
are you really sure you cannot get the behavior you need within
the current framework and using existing facilities?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html