Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1260883

Re: Kernel 4.3 breaks security in systems using capabilities

From Andy Lutomirski <luto@amacapital.net>
Newsgroups linux.kernel
Subject Re: Kernel 4.3 breaks security in systems using capabilities
Date 2015-11-02 20:00 +0100
Message-ID <qqsuK-nX-7@gated-at.bofh.it> (permalink)
References <qqrIn-7E-11@gated-at.bofh.it> <qqsbn-hk-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


On Mon, Nov 2, 2015 at 10:38 AM, Richard Weinberger
<richard.weinberger@gmail.com> wrote:
> CC'ing patch authors.
>
> On Mon, Nov 2, 2015 at 7:06 PM, Klaus Ethgen <Klaus+lkml@ethgen.de> wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>>
>> Hi,
>>
>> I read recently about patch 58319057b7847667f0c9585b9de0e8932b0fdb08
>> which made it into kernel 4.3 recently. And I have to say that I was
>> shocked on how could such a patch that breaks normal use of capabilities
>> make it into the kernel.
>>
>> Usually I have set very own crafted capabilities set to files instead of
>> having them SUID root. With that, I have a comparable set of inheritable
>> capabilities set for limited users. That allows me to nearly drop all
>> SUID binaries and replace it by only giving the processes the
>> capabilities they need but only if the users are allowed to act with
>> that capabilities. Especially, and that is important, it inhibit any
>> leak of rights to any forked process, be it indented or by a security
>> problem of the binary.
>>
>> With the patch above, any process that is spawned by such a program will
>> inherit the raised capabilities if it has no own filecapabilities set.
>> Even worse, even every user made tool can be target for such
>> escalations! That drives the benefits in security of capabilities over
>> SUID ad-absurdum.

Can you describe what it is that you think changed in 4.3 that breaks
anything?  The behavior of inheritable capabilities shouldn't have
changed.

>>
>> Let me add here, that I disagree with Andy Lutomirski about the
>> usefulness of capability inheritance in kernels before that patch. They
>> was fully usefull to only allow selective capabilities if both, the
>> binary and the user was allowed to use it. I never want to have any
>> capabilities for processes that I did not allow them to have. Even
>> worse, I never want any capabilities allowed for any shell. It is
>> horrible to even think about such a possibility!.
>>
>>> Users with nonzero pA are unlikely to unintentionally leak that
>>> capability. If they run programs that try to drop privileges, dropping
>>> privileges will still work.
>>
>> Even that is naiv. There are only few programs out there that do
>> actively drop privileges. Most are agnostic about capabilities. But this
>> crappy patch introduce a need for _every_ tool to drop all capabilities
>> right after start to stay in a secure system.
>>

I don't know what you mean.  Concrete examples are welcome.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

Kernel 4.3 breaks security in systems using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-02 19:10 +0100
  Re: Kernel 4.3 breaks security in systems using capabilities Richard Weinberger <richard.weinberger@gmail.com> - 2015-11-02 19:40 +0100
    Re: Kernel 4.3 breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-02 20:00 +0100
    Re: Kernel 4.3 breaks security in systems using capabilities Linus Torvalds <torvalds@linux-foundation.org> - 2015-11-02 20:00 +0100
      Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-02 20:20 +0100
        Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-02 20:50 +0100
          Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 11:30 +0100
            Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-05 17:20 +0100
              Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 18:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-05 18:40 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3  breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 18:50 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3  breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-05 20:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3  breaks security in systems using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-05 23:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-06 15:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-06 17:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3 breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-06 18:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3 breaks security in systems using capabilities Casey Schaufler <casey@schaufler-ca.com> - 2015-11-06 19:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3 breaks security in systems using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-06 19:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-06 19:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-06 19:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-07 12:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using  capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-08 18:10 +0100
                Re: Kernel 4.3 breaks security in systems using capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-09 17:40 +0100
                Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-09 18:30 +0100
                Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using  capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-09 20:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-09 22:30 +0100
                Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-10 01:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 13:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-10 13:50 +0100
                Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 14:20 +0100
                Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in systems using  capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-10 14:40 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in  systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 19:10 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in  systems using capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-10 21:50 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in  systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 14:50 +0100
                Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in systems  using  capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-11 03:10 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in  systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-11 11:20 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in  systems  using  capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-11 12:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks   security in  systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-11 12:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security  in systems  using capabilities Christoph Lameter <cl@linux.com> - 2015-11-10 16:30 +0100
            Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-05 17:30 +0100
              Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 18:30 +0100

csiph-web