Messages in this thread | | | Date | Wed, 30 Dec 2009 12:35:13 -0600 | From | "Serge E. Hallyn" <> | Subject | Re: [RFC][PATCH v2] Unprivileged: Disable raising of privileges |
| |
Quoting Andrew G. Morgan (morgan@kernel.org): > Eric, > > I'm not clear why capabilities need to be manipulated by this feature > (the pure capability support already has a feature for disabling > privilege and blocking unsafe, or insufficient privilege, execution).
Not entirely - this option would also prevent file capabilities from being honored.
> Perhaps I'm just unclear what features can be more safely enabled with > this in effect - that is, your description suggests that this is why > you are doing this, but leaves it unclear what they are. Could you > take a few moments to enumerate some of them?
There are two desirable features which are at the moment unsafe for unprivileged users, because it allows them to fool privileged (setuid or bearing file capabilities) programs. One is to unconditionally restrict privilege to yourself and all your descendents. The recent disablenetwork patchset is one example. The other is the ability to make substantial changes to your environment in a private namespace. A private namespace can protect already-running privileged program, but cannot protect privilege-bearing binaries. Unless we prevent them from bearing privilege. Which is what this patch does.
-serge
| |