On Sat, Dec 8, 2012 at 3:37 PM, Andy Lutomirski <l...@amacapital.net> wrote:
>
> Again (any mainly because I feel like there's a giant mental
> disconnect here in that I really don't understand wtf the current /
> POSIX system is trying to accomplish): what would be wrong with a
> model in which capabilities could be freely passed from parent to
> child? Why would it be insecure? Why would it be error-prone?
> There's got to be *some* reason why it's not in use right now.
>
> I can speculate as to the reason the current scheme is barely used
> except internally to a few daemons (and why AFAIK there is no one
> making serious use of fI): it's basically incomprehensible. Security
> systems should be simple enough to understand and analyze. "Here is
> the set of things that I and my descendants can do" (the Windows
> model) is simple. "Here is the set of things I can do (pP). Here is
> a different set of things that a certain class of my descendants can
> do (pI). Here is the class of descendants that can do those things
> (fI). And here's a different class of descendants that can do things
> no matter who invokes them (fP)." is really hard to understand.
>
> It's especially bad because granting CAP_DAC_READ_SEARCH to user "foo"
> doesn't mean anything. Is he authorized to back things up to
> encrypted storage? Is he authorized to read any file for any purpose?
> Is he authorized to read things on behalf of properly authenticated
> remote users? No one knows because it depends entirely on what set of
> binaries with CAP_DAC_READ_SEARCH=i he can find.
>
> * I see "If pathconf() indicates that {_POSIX_CAP_PRESENT} is not in
> effect for a file, then the capability state of that file shall be
> implementation defined." I think this means that the designers didn't
> actually decide whether fI should default to all zeros or all ones.
I just tried to search to find actual uses of pI/fI. Here's what I found:
http://www.engardelinux.org/modules/index/list_archives.cgi?list=linux-security-module&page=0144.html&month=2010-04
A user (Stephen Hemminger, who presuambly understands Linux fairly
well...) who gave up because normal programs couldn't inherit
capabilities.
http://fpmurphy.blogspot.com/2009/05/linux-security-capabilities.html
Gives an (incorrect, AFAICT) example in which pI=cap_net_raw means "can ping"
http://forums.fedoraforum.org/showthread.php?t=203879
An unanswered question which the poster thought (I think) that giving
a user a capability would have some effect.
OK, bored of this search now. Having trouble finding anything that works.
--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
