Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities

From: Klaus Ethgen
Date: Fri Nov 06 2015 - 12:56:32 EST

Hash: SHA512

Am Fr den 6. Nov 2015 um 16:53 schrieb Theodore Ts'o:
> On Fri, Nov 06, 2015 at 02:58:36PM +0100, Klaus Ethgen wrote:
> > But that left out completely the, I think more important, usecase of
> > _removing_ SUID completely and _replacing_ it with very tight capability
> > setting. And that is what I always talked about.
> I don't believe this is ever going to be possible. And I'm not
> talking about it from a technical perspective, but from a practical
> and cultural perspective.
> The problem with removing SUID and inheritance completely is that you
> have to anticipate all possible use cases where a system administrator
> might want to use a root shell. This means analyzing all possible use
> cases for all possible system administrators how they might need to
> use a root shell to fix or management a system,

That is not my interest at all. I wan't to get rid of all the SUID
_binaries_ that are used by _normal_ users. (And me counting as normal
user in the most time too.)

I do not want to remove root or something like that. For that task,
capabilities is definitively the wrong tool.

> and then either (a)
> provide a new, specialized tool that solves that particular use case,
> while respecting the rules of least privilege, or (b) figure out how
> to expand that executable's fI mask, and worse, if that executable
> fork and exec's helper programs, those helper programs will need to
> have expanded fI masks. And that's if all of the commands that a
> system administrator needs to run are compiled executables. Now
> consider what happens when a system administrator needs to run python,
> perl, or shell scripts with elevated privileges.

Independent of, that I do not want to address this, I never want to have
a shell (sh, perl, python, ruby, ...) in such a construct.

> In the light of that, using things like ambient capabilities, or using
> setuid binary that immediately drops all caps that it needs, is
> probably the best we're going to get.

I do never want that! Even to think about such a way to give any shell
raised rights is horrible! And that horrible idea is it that makes all
the ambient capabilities that bad.

- --
Klaus Ethgen
pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen <Klaus@xxxxxxxxx>
Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C
Version: GnuPG v1

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at