Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in systems using capabilities

From	Austin S Hemmelgarn <ahferroin7@gmail.com>
Newsgroups	linux.kernel
Subject	Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in systems using capabilities
Date	2015-11-10 14:40 +0100
Message-ID	<qthjr-5Fv-7@gated-at.bofh.it> (permalink)
References	(6 earlier) <qt2aJ-3vI-11@gated-at.bofh.it> <qt4FA-5Ym-9@gated-at.bofh.it> <qtfKG-4Aq-25@gated-at.bofh.it> <qtgx4-57n-13@gated-at.bofh.it> <qth06-5xS-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On 2015-11-10 08:19, Klaus Ethgen wrote:
> Hi Ted, hy others in this discussion,
>
> Am Di den 10. Nov 2015 um 13:40 schrieb Theodore Ts'o:
>> Whether or not that will be acceptable upstream, I don't know, mainly
>> because I think a strong case can be made that such a patch has an
>> audience of one, and adding more complexity here for an idea which has
>> been time-tested over decades to be a failure is just not a good idea.
>
> I wouldn't tell the implementation until now to be a failure. It helped
> a lot to keep a system sane. It is true that all distributions ignored
> capabilities completely but I don't think that is due the design.
I think it's mostly due to the fact that there are a lot of potential 
security issues in using capabilities as implemented in Linux (and other 
POSIX systems), and unlike chroot(), it's not as easy to protect against 
stuff trying to bypass them while still keeping them useful. If you do a 
web search you can relatively easily find info on how to use many of the 
defined capabilities to get root-equivalent access (CAP_SYS_ADMIN and 
CAP_SYS_MODULE are obvious, but many of the others can be used also if 
you know what you are doing, for example CAP_DAC_OVERRIDE+CAP_SYS_BOOT 
can be used on non-SecureBoot systems to force the system to reboot into 
an arbitrary kernel).

Thread

Kernel 4.3 breaks security in systems using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-02 19:10 +0100
  Re: Kernel 4.3 breaks security in systems using capabilities Richard Weinberger <richard.weinberger@gmail.com> - 2015-11-02 19:40 +0100
    Re: Kernel 4.3 breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-02 20:00 +0100
    Re: Kernel 4.3 breaks security in systems using capabilities Linus Torvalds <torvalds@linux-foundation.org> - 2015-11-02 20:00 +0100
      Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-02 20:20 +0100
        Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-02 20:50 +0100
          Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 11:30 +0100
            Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-05 17:20 +0100
              Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 18:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-05 18:40 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3  breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 18:50 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3  breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-05 20:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3  breaks security in systems using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-05 23:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-06 15:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-06 17:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3 breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-06 18:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3 breaks security in systems using capabilities Casey Schaufler <casey@schaufler-ca.com> - 2015-11-06 19:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3 breaks security in systems using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-06 19:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-06 19:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-06 19:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-07 12:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using  capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-08 18:10 +0100
                Re: Kernel 4.3 breaks security in systems using capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-09 17:40 +0100
                Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-09 18:30 +0100
                Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using  capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-09 20:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-09 22:30 +0100
                Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-10 01:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 13:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-10 13:50 +0100
                Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 14:20 +0100
                Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in systems using  capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-10 14:40 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in  systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 19:10 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in  systems using capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-10 21:50 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in  systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 14:50 +0100
                Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in systems  using  capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-11 03:10 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in  systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-11 11:20 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in  systems  using  capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-11 12:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks   security in  systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-11 12:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security  in systems  using capabilities Christoph Lameter <cl@linux.com> - 2015-11-10 16:30 +0100
            Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-05 17:30 +0100
              Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 18:30 +0100

csiph-web