On Tue, May 12, 2026 at 11:20:51AM -0600, Jonathan Corbet wrote: > Willy Tarreau <[email protected]> writes: > > > The use of automated tools to find bugs in random locations of the kernel > > induces a raise of security reports even if most of them should just be > > reported as regular bugs. This patch is an attempt at drawing a line > > between what qualifies as a security bug and what does not, hoping to > > improve the situation and ease decision on the reporter's side. > > > > It defers the enumeration to a new file, threat-model.rst, that tries > > to enumerate various classes of issues that are and are not security > > bugs. This should permit to more easily update this file for various > > subsystem-specific rules without having to revisit the security bug > > reporting guide. > > One thing here: > > [...] > > > +* **Capability-based protection**: > > + > > + * users not having the ``CAP_SYS_ADMIN`` capability may not alter the > > + kernel's configuration, memory nor state, change other users' view of > > the > > + file system layout, grant any user capabilities they do not have, nor > > + affect the system's availability (shutdown, reboot, panic, hang, or > > making > > + the system unresponsive via unbounded resource exhaustion). > > That is pretty demonstrably not true, and will likely elicit challenges > at some point. There are a lot of "make me root" capabilities that > enable users to do all of those things; consider CAP_DAC_OVERRIDE as an > obvious example. I think that just about all of the capabilities will > enable at least one of those things - that's why the capabilities exist > in the first place. So I think this needs to be written far more > generally.
You are right, there are more capabilities, but we get bug reports all the time that basically come down to "a user with CAP_SYS_ADMIN can go and do..." which are pointless for us to be handling. Just got one a few minutes ago, so LLMs are churning this crap out quite frequently. So any rewording of this to prevent us from getting these pointless reports would be great. > As a lower-priority thing, lockdown mode is meant to at least try to > provide some stronger guarantees, and lockdown circumvention seems to be > normally be viewed as a security bug. Worth a mention? lockdown issues are best discussed on the list where the lockdown people are as most of us feel that really isn't a "security" thing at all :) thanks, greg k-h
