lkml.org 
[lkml]   [2015]   [Feb]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH] capabilities: Ambient capability set V1
    On Mon, Feb 23, 2015 at 7:53 AM, Christoph Lameter <cl@linux.com> wrote:
    > On Mon, 23 Feb 2015, Andy Lutomirski wrote:
    >
    >> At the very least, I think it needs to define and implement what
    >> happens when a cap is added to ambient and then dropped from
    >> permitted. We also may need LSM_UNSAFE_something to clear the ambient
    >> set to avoid a major security issue.
    >
    > The ambient cap needs to stay otherwise we will have issues again if
    > another binary/script is forked. IMHO the only way to switch off an
    > ambient capability should be another prctl action. The intend is after all
    > to have the cap available for all inherited processes.

    No, sadly.

    If you set ambient caps and then run a setuid program (without
    no_new_privs), then the ambient set *must* be cleared by the kernel
    because that's what the setuid program expects. Yes, the whole
    concept of setuid is daft, but it exists and we have to keep it
    working safely, or at least as safely as it ever worked.

    --Andy


    \
     
     \ /
      Last update: 2015-02-23 17:21    [W:3.437 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site