Re: [capabilities] Allow normal inheritance for a configurable set of capabilities

[Christoph Lameter]

On Tue, 3 Feb 2015, Andy Lutomirski wrote:

> >                  */
> >                 new->cap_permitted.cap[i] =
> >                         (new->cap_bset.cap[i] & permitted) |
> > -                       (new->cap_inheritable.cap[i] & inheritable);
> > +                       (new->cap_inheritable.cap[i] & inheritable) |
> > +                       (ambient & inheritable);
>
> Is there a clear reason why no non-permitted bits can be inheritable?
> If not, then I think this should be (ambient & inheritable &
> permitted).

Inherited caps via ambient are always be permitted. Otherwise the pass
through is not working.

> Do we need to think about the effective mask here?  What happens when
> we exec a setuid program or a program with a non-empty fP set?  I
> think that, in these cases, we should strongly consider clearing the
> ambient set.  For a different approach, see below.
>
> >
> >                 if (permitted & ~new->cap_permitted.cap[i])
> >                         /* insufficient to execute correctly */
> >                         ret = -EPERM;
> > +
> > +               if (capable(CAP_AMBIENT_MASK))
> > +                       new->cap_ambient.cap[i] = inheritable;
> > +               else
> > +                       new->cap_ambient.cap[i] = ambient;
>
> IMO this is really weird.  I don't think that the presence of an
> effective cap should change the cap equations.  (Also, that should be
> nsown_capable.)

Well how would the ambient mask to be set? The other options are adding a
new syscall and having to go through an interation of the capabilities
tools and/or kernel syscall API changes.

> Can we please make this an explicit opt-in?  For example, allow a
> process to set an ambient cap bit if that bit is both permitted and
> inheritable.  I'd prefer having it be a single control, though -- just
> prctl(PR_SET_ALWAYS_INHERIT_CAPS, 1, 0, 0, 0) would set a single bit
> that would cause all inheritable bits to be treated as ambient.

Opt-in does not work since the caps need to be passed
through binaries that do not use the capabilities.

> Here's a slight variant that might be more clearly safe: add an
> inherited per-process bit that causes all files to act as though fI is
> the full set.  Only allow setting that bit if no_new_privs is set.

CAP_INHERIT_ALL ?

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/