[lkml]   [2000]   [Feb]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Capabilities
    "Theodore Y. Ts'o" <tytso@MIT.EDU> writes:

    > But if we want to support the full capability model, then we
    > can't take shortcuts like that. As I said earlier, it's very different
    > from the Unix model, and I'm not so convinced that sysadmins will be
    > able to deal with it correctly. If we're going to try to do
    > capabilities, however, we might as well try to do them right.

    As a sysadmin who's concerned about security, I think I can safely say
    that it may take some time before the full use of capabilities is
    realized--there's a lot of stuff that needs to be changed around
    before everything on even a freshly installed system is set up right.
    But--eventually, some Linux distro will have reasonable cap settings
    from the start, and people will vet stuff on their own.

    Having a way to be sure the kernel is enforcing this policy is much
    better than trusting *any* programmer to do it right in their own
    software. It's the old security kernel model--there's only one piece
    of code you need to trust to be right--and that's the kernel
    capability stuff. (Not small, but smaller than the entire universe of
    software.) For some programs that might need extra capabilities and
    then drop them (an FTP server which wants to set its uid, then drop
    that capability when a user logs in) there's still a much smaller
    worry when you only need to check that one possibility.

    But I think most people realize that. :)

    Pavel also mentioned that there's no way to prevent exec--I disagree
    (though I haven't looked at the list of capabilities in Linux or
    Posix, I'm afraid). Certainly, if you deny exec abilities you also
    want to deny, at least, the ability to mmap files as executable, and
    you also want to arrange that executable pages are never writable.

    And most importantly, the big thing that exec could do that mmap can't
    is get new capabilities by execing a setcap executable. (Sure, I can
    mmap su into myself. So what? I can't actually do anything with it!)


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:56    [W:0.023 / U:1.168 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site