RFC: capabilities(7): notes for kernel developers

[Michael Kerrisk (man-pages)]

Hello all,

Because the topic every now then comes up "which capability 
should I associate with the new feature that I'm adding to 
the kernel?", I propose to add the text below to the 
capabilities(7) man page [1] with some recommendations
on how to go about choosing. I would be happy
to get feedback, suggestions for improvement and
so on.

Cheers,

Michael

[1] http://man7.org/linux/man-pages/man7/capabilities.7.html


   Notes to kernel developers
       When adding a new kernel feature that  should  be  governed  by  a
       capability, consider the following points.

       *  The  goal of capabilities is divide the power of superuser into
          small pieces, such that if a program that has  capabilities  is
          compromised, its power to do damage to the system would be much
          less than a similar set-user-ID-root program.

       *  You have the choice of either creating  a  new  capability  for
          your  new  feature,  or associating the feature with one of the
          existing capabilities.  Because the size of capability sets  is
          currently  limited to 64 bits, the latter option is preferable,
          unless there are compelling reasons to take the former option.

       *  To determine which existing capability might best be associated
          with your new feature, review the list of capabilities above in
          order to find a "silo" into which your new feature best fits.

       *  Don't choose CAP_SYS_ADMIN if you can  possibly  avoid  it!   A
          vast  proportion  of  existing capability checks are associated
          with this capability, to the point where it  can  plausibly  be
          called "the new root".  Don't make the problem worse.  The only
          new features that should be associated with  CAP_SYS_ADMIN  are
          ones that closely match existing uses in that silo.

       *  If  you have determined that it really is necessary to create a
          new capability for your feature, avoid making (and  naming)  it
          as  a "single-use" capability.  Thus, for example, the addition
          of the highly specific CAP_WAKE_ALARM was probably  a  mistake.
          Instead,  try  to  identify  and  name your new capability as a
          broader silo into which other related future  use  cases  might
          fit.


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/