Re: [RFC] Capabilities still can't be inherited by normal programs

[Andy Lutomirski]

On Sat, Dec 8, 2012 at 3:37 PM, Andy Lutomirski <luto@xxxxxxxxxxxxxx> wrote:
>
> Again (any mainly because I feel like there's a giant mental
> disconnect here in that I really don't understand wtf the current /
> POSIX system is trying to accomplish): what would be wrong with a
> model in which capabilities could be freely passed from parent to
> child?  Why would it be insecure?  Why would it be error-prone?
> There's got to be *some* reason why it's not in use right now.
>
> I can speculate as to the reason the current scheme is barely used
> except internally to a few daemons (and why AFAIK there is no one
> making serious use of fI): it's basically incomprehensible.  Security
> systems should be simple enough to understand and analyze.  "Here is
> the set of things that I and my descendants can do" (the Windows
> model) is simple.  "Here is the set of things I can do (pP).  Here is
> a different set of things that a certain class of my descendants can
> do (pI).  Here is the class of descendants that can do those things
> (fI).  And here's a different class of descendants that can do things
> no matter who invokes them (fP)." is really hard to understand.
>
> It's especially bad because granting CAP_DAC_READ_SEARCH to user "foo"
> doesn't mean anything.  Is he authorized to back things up to
> encrypted storage?  Is he authorized to read any file for any purpose?
>  Is he authorized to read things on behalf of properly authenticated
> remote users?  No one knows because it depends entirely on what set of
> binaries with CAP_DAC_READ_SEARCH=i he can find.
>
> * I see "If pathconf() indicates that {_POSIX_CAP_PRESENT} is not in
> effect for a file, then the capability state of that file shall be
> implementation defined."  I think this means that the designers didn't
> actually decide whether fI should default to all zeros or all ones.

I just tried to search to find actual uses of pI/fI.  Here's what I found:

http://www.engardelinux.org/modules/index/list_archives.cgi?list=linux-security-module&page=0144.html&month=2010-04

A user (Stephen Hemminger, who presuambly understands Linux fairly
well...) who gave up because normal programs couldn't inherit
capabilities.

http://fpmurphy.blogspot.com/2009/05/linux-security-capabilities.html

Gives an (incorrect, AFAICT) example in which pI=cap_net_raw means "can ping"

http://forums.fedoraforum.org/showthread.php?t=203879

An unanswered question which the poster thought (I think) that giving
a user a capability would have some effect.

OK, bored of this search now.  Having trouble finding anything that works.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/