Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities

From	"Serge E. Hallyn" <serge@hallyn.com>
Newsgroups	linux.kernel
Subject	Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities
Date	2015-11-06 19:20 +0100
Message-ID	<qrTMe-80j-17@gated-at.bofh.it> (permalink)
References	(5 earlier) <qry55-2hu-41@gated-at.bofh.it> <qrATh-44X-23@gated-at.bofh.it> <qrPID-5cI-23@gated-at.bofh.it> <qrRAK-6pR-11@gated-at.bofh.it> <qrTsS-7CR-23@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, Nov 06, 2015 at 06:56:20PM +0100, Klaus Ethgen wrote:
> Am Fr den  6. Nov 2015 um 16:53 schrieb Theodore Ts'o:
> > In the light of that, using things like ambient capabilities, or using
> > setuid binary that immediately drops all caps that it needs, is
> > probably the best we're going to get.
> 
> I do never want that! Even to think about such a way to give any shell
> raised rights is horrible! And that horrible idea is it that makes all
> the ambient capabilities that bad.

I sympathize with your point of view, but Christoph's use case really was
a good one.  A piece of system configuration software needs to do some
networking setup with some privilege, including calling scripts.  It can
either do so as root or not at all - polluting every program that will end
up getting called with fI is not only ugly but simply doesn't work (because
scripts).  Saying that the whole thing must be written as self-contained
executable that never needs to be re-execed is frequently unrealistic.
So this allows a piece of software to run with reduce privilege, and it
is an improvement over the previous state of affairs.

It is not intended for login shells.

I would have been happy if there had been a default-off PR_ENABLE_AMBIENT
prctl which required a new CAP_ENABLE_AMBIENT capability to turn on, but
the current set of rules which removes bits from pA whenever doing an
action which capability-aware software does something which it would have
reasonably expected to drop privilege is a nice safeguard.

-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

Kernel 4.3 breaks security in systems using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-02 19:10 +0100
  Re: Kernel 4.3 breaks security in systems using capabilities Richard Weinberger <richard.weinberger@gmail.com> - 2015-11-02 19:40 +0100
    Re: Kernel 4.3 breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-02 20:00 +0100
    Re: Kernel 4.3 breaks security in systems using capabilities Linus Torvalds <torvalds@linux-foundation.org> - 2015-11-02 20:00 +0100
      Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-02 20:20 +0100
        Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-02 20:50 +0100
          Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 11:30 +0100
            Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-05 17:20 +0100
              Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 18:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-05 18:40 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3  breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 18:50 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3  breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-05 20:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3  breaks security in systems using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-05 23:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-06 15:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-06 17:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3 breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-06 18:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3 breaks security in systems using capabilities Casey Schaufler <casey@schaufler-ca.com> - 2015-11-06 19:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3 breaks security in systems using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-06 19:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-06 19:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-06 19:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-07 12:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using  capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-08 18:10 +0100
                Re: Kernel 4.3 breaks security in systems using capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-09 17:40 +0100
                Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-09 18:30 +0100
                Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using  capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-09 20:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-09 22:30 +0100
                Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-10 01:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 13:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-10 13:50 +0100
                Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 14:20 +0100
                Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in systems using  capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-10 14:40 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in  systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 19:10 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in  systems using capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-10 21:50 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in  systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 14:50 +0100
                Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in systems  using  capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-11 03:10 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in  systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-11 11:20 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in  systems  using  capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-11 12:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks   security in  systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-11 12:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security  in systems  using capabilities Christoph Lameter <cl@linux.com> - 2015-11-10 16:30 +0100
            Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-05 17:30 +0100
              Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 18:30 +0100

csiph-web