Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities

From	"Serge E. Hallyn" <serge@hallyn.com>
Newsgroups	linux.kernel
Subject	Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities
Date	2015-11-08 18:10 +0100
Message-ID	<qsBDA-2Wb-7@gated-at.bofh.it> (permalink)
References	(5 earlier) <qrPID-5cI-23@gated-at.bofh.it> <qrRAK-6pR-11@gated-at.bofh.it> <qrTsS-7CR-23@gated-at.bofh.it> <qrTMe-80j-17@gated-at.bofh.it> <qs9xD-1w6-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Sat, Nov 07, 2015 at 12:02:47PM +0100, Klaus Ethgen wrote:
> Hi Guys,
> 
> Am Fr den  6. Nov 2015 um 19:18 schrieb Serge E. Hallyn:
> > I would have been happy if there had been a default-off PR_ENABLE_AMBIENT
> > prctl which required a new CAP_ENABLE_AMBIENT capability to turn on, but
> > the current set of rules which removes bits from pA whenever doing an
> > action which capability-aware software does something which it would have
> > reasonably expected to drop privilege is a nice safeguard.
> 
> Well, not really. You can only prevent ambient capabilities to be given
> to tools you don't want to have any capabilities by setting that tool
> SUID or setting just one random capability for it.

Right, I didn't say you could say "/bin/foo is never run with capabilities."
Rather, if a piece of software specifically tries to drop all privilege
before running a piece of software, then ambient capabilities is designed
to honor that.

> By the way, guys, can we start to _not_ add every one in this discussion
> to the Cc? Currently I get every mail twice. One from the list and one
> from Cc. I still leave all Ccs intact with this mail but I would prefer
> to just reply to the list. If anybody is not reading the list and would
> like to get the mail, please insist.

That is (a) hard to do becase we don't know who is on the list, and (2)
not useful with lkml in particular because many people read only email
directly To them, not lkml email.  (My procmail filters my name to my
inbox, so I typically get 3-4 copies;  easily handled)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

Kernel 4.3 breaks security in systems using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-02 19:10 +0100
  Re: Kernel 4.3 breaks security in systems using capabilities Richard Weinberger <richard.weinberger@gmail.com> - 2015-11-02 19:40 +0100
    Re: Kernel 4.3 breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-02 20:00 +0100
    Re: Kernel 4.3 breaks security in systems using capabilities Linus Torvalds <torvalds@linux-foundation.org> - 2015-11-02 20:00 +0100
      Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-02 20:20 +0100
        Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-02 20:50 +0100
          Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 11:30 +0100
            Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-05 17:20 +0100
              Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 18:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-05 18:40 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3  breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 18:50 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3  breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-05 20:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3  breaks security in systems using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-05 23:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-06 15:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-06 17:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3 breaks security in systems using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-06 18:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3 breaks security in systems using capabilities Casey Schaufler <casey@schaufler-ca.com> - 2015-11-06 19:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  Kernel 4.3 breaks security in systems using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-06 19:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-06 19:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-06 19:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-07 12:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re:  [KERNEL] Re:  [KERNEL] Re:  Kernel 4.3  breaks security in systems using  capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-08 18:10 +0100
                Re: Kernel 4.3 breaks security in systems using capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-09 17:40 +0100
                Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-09 18:30 +0100
                Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using  capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-09 20:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-09 22:30 +0100
                Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-10 01:10 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 13:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-10 13:50 +0100
                Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 14:20 +0100
                Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in systems using  capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-10 14:40 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in  systems using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 19:10 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks security in  systems using capabilities Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-11-10 21:50 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in  systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-10 14:50 +0100
                Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in systems  using  capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-11 03:10 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in  systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-11 11:20 +0100
                Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks  security in  systems  using  capabilities Theodore Ts'o <tytso@mit.edu> - 2015-11-11 12:00 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] [PATCH] Kernel 4.3 breaks   security in  systems  using  capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-11 12:20 +0100
                Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security  in systems  using capabilities Christoph Lameter <cl@linux.com> - 2015-11-10 16:30 +0100
            Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems  using capabilities Andy Lutomirski <luto@amacapital.net> - 2015-11-05 17:30 +0100
              Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks  security in systems  using capabilities Klaus Ethgen <Klaus+lkml@ethgen.de> - 2015-11-05 18:30 +0100

csiph-web