netdev - Re: [PATCH iproute2] ip: do not drop capabilities if net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20180514211005.4f7cb98a@xeon-e3>
Date:   Mon, 14 May 2018 21:10:05 -0700
From:   Stephen Hemminger <stephen@...workplumber.org>
To:     Luca Boccassi <bluca@...ian.org>
Cc:     netdev@...r.kernel.org, dsahern@...il.com, luto@...capital.net
Subject: Re: [PATCH iproute2] ip: do not drop capabilities if net_admin=i is
 set

On Fri, 11 May 2018 13:39:56 +0100
Luca Boccassi <bluca@...ian.org> wrote:

> Users have reported a regression due to ip now dropping capabilities
> unconditionally.
> zerotier-one VPN and VirtualBox use ambient capabilities in their
> binary and then fork out to ip to set routes and links, and this
> does not work anymore.
> 
> As a workaround, do not drop caps if CAP_NET_ADMIN (the most common
> capability used by ip) is set with the INHERITABLE flag.
> Users that want ip vrf exec to work do not need to set INHERITABLE,
> which will then only set when the calling program had privileges to
> give itself the ambient capability.
> 
> Fixes: ba2fc55b99f8 ("Drop capabilities if not running ip exec vrf with libcap")
> 
> Signed-off-by: Luca Boccassi <bluca@...ian.org>

Applied