lkml.org 
[lkml]   [2003]   [Dec]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: request: capabilities that allow users to drop privileges further
* Felix von Leitner (felix-kernel@fefe.de) wrote:
> I would like to be able to drop capabilities that every normal user has,
> so that network servers can limit the impact of possible future security
> problems further. For example, I want my non-cgi web server to be able
> to drop the capabilities to

Using existing capabilities system you can limit many of these. Just
dropping privs from uid = 0 to anything else is a good start.

> * fork

rlimit

> * execve

mount fs noexec

> * ptrace

drop CAP_SYS_PTRACE

> * load kernel modules

drop CAP_SYS_MODULE

> * mknod

drop CAP_MKNOD

> * write to the file system

mount fs r/o.

In general, most of what you ask for is already there. Otherwise use
some MAC policy that gives you the control you want (check out SELinux
for example).

thanks,
-chris
--
Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:59    [W:0.081 / U:2.312 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site