Messages in this thread | | | From | Andy Lutomirski <> | Date | Thu, 26 Feb 2015 12:51:57 -0800 | Subject | Re: [PATCH] capabilities: Ambient capability set V1 |
| |
On Thu, Feb 26, 2015 at 12:34 PM, Serge E. Hallyn <serge@hallyn.com> wrote: > On Thu, Feb 26, 2015 at 02:13:00PM -0600, Christoph Lameter wrote: >> On Thu, 26 Feb 2015, Serge E. Hallyn wrote: >> >> > Andrew Morgan was against that. What if we changed >> > >> > pE' = pP' & (fE | pA) >> > >> > to >> > >> > if (pA) >> > pE' = pP' & fE >> > else >> > pE' = pP' >> > >> >> Same problem as before. The ambient bits will not be set in pE'. > > And what if I weren't scatterbrained and we did > > if (pA) > pE' = pP' > else > pE' = pP' & fE > > All pP' bits would be set in pE'.
That seems reasonable to me, except for my paranoia:
What if there's a program with CAP_DAC_OVERRIDE in fP and fE set to the empty set (i.e. the magic effective bit cleared), and the program relies on that. A malicious user has CAP_NET_BIND and sets pA = CAP_NET_BIND. Boom!
If we changed that to if (pA') and zeroed pA if fP is non-empty then this problem goes away.
--Andy
-- Andy Lutomirski AMA Capital Management, LLC
| |