Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities

[Serge E. Hallyn]

On Thu, Nov 05, 2015 at 06:17:01PM +0100, Klaus Ethgen wrote:
> Hi Serge,
> 
> Am Do den  5. Nov 2015 um 17:15 schrieb Serge E. Hallyn:
> > I think if you follow your idea to its logical conclusions, you end
> > up wanting set SECURE_ALL_BITS | SECURE_ALL_LOCKS, which will include
> > SECURE_NO_CAP_AMBIENT_RAISE, disabling ambient capabilities.
> 
> That I did miss out and seems to be the solution for the problem. So
> adding cap_secure_all_bits,cap_secure_all_locks=ep to every binary that
> gets other caps should solve it?

No that doesn't work, you have to use prctl to set those bits.  If you
can get your system to be fully rootless, you can have init or initramfs
do this for you.  It'll mean that root and setuid-root binaries have no
automatic privileges beside owning host (proc/sys) files.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/