Messages in this thread | | | From | Andy Lutomirski <> | Date | Mon, 2 Feb 2015 09:18:58 -0800 | Subject | Re: [capabilities] Allow normal inheritance for a configurable set of capabilities |
| |
On Mon, Feb 2, 2015 at 9:12 AM, Serge Hallyn <serge.hallyn@ubuntu.com> wrote: > A key concept behind posix capabilities is that the privilege comes from > both the person and the file being executed. As you say below basically > anything can be executed by the program so that is completely violated. > > Still, it's not that different from mmapping some arbitrary code and > jumping into it whlie retaining caps. > > If we were to support such a feature, I'm thinking I'd prefer we do > it somewhat analogously to the capability bounding set. Perhaps add a > ambient_inh_caps set or something. Empty by default. To add caps to it you > must have the cap in your permitted set already. (Ok to do in a user > namespace). Then at exec, > > pP' = (X & fP) | (pI & fI) | (pI & pA) > > pA being your ambient_inh set > > Not saying this is a good idea necessarily, but worth thinking about.
This isn't obviously a bad formulation. We could control pA using some syscall.
Another formulation would be a single per-user-ns or inherited-per-process bit that sets fI to the full set regardless of file caps. Dealing with the file effective bit will be an added complication, as will dealing with setuid binaries.
How many of you will be at LSF/MM? This might be a decent topic.
--Andy
| |