[lkml]   [2008]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 1/6] file capabilities: add no_file_caps switch (v3)
    From: Serge Hallyn <>

    Add a no_file_caps boot option when file capabilities are
    compiled into the kernel (CONFIG_SECURITY_FILE_CAPABILITIES=y).

    This allows distributions to ship a kernel with file capabilities
    compiled in, without forcing users to use (and understand and
    trust) them.

    When no_file_caps is specified at boot, then when a process executes
    a file, any file capabilities stored with that file will not be
    used in the calculation of the process' new capability sets.

    This means that booting with the no_file_caps boot option will
    not be the same as booting a kernel with file capabilities
    compiled out - in particular a task with CAP_SETPCAP will not
    have any chance of passing capabilities to another task (which
    isn't "really" possible anyway, and which may soon by killed
    altogether by David Howells in any case), and it will instead
    be able to put new capabilities in its pI. However since fI
    will always be empty and pI is masked with fI, it gains the
    task nothing.

    We also support the extra prctl options, setting securebits and
    dropping capabilities from the per-process bounding set.

    The other remaining difference is that killpriv, task_setscheduler,
    setioprio, and setnice will continue to be hooked. That will
    be noticable in the case where a root task changed its uid
    while keeping some caps, and another task owned by the new uid
    tries to change settings for the more privileged task.

    Sep 23 2008: nixed file_caps_enabled when file caps are
    not compiled in as it isn't used.
    Document no_file_caps in kernel-parameters.txt.

    Signed-off-by: Serge Hallyn <>
    Acked-by: Andrew G. Morgan <>
    Documentation/kernel-parameters.txt | 4 ++++
    include/linux/capability.h | 3 +++
    kernel/capability.c | 11 +++++++++++
    security/commoncap.c | 5 +++++
    4 files changed, 23 insertions(+), 0 deletions(-)

    diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
    index 1150444..cbb04bf 100644
    --- a/Documentation/kernel-parameters.txt
    +++ b/Documentation/kernel-parameters.txt
    @@ -1393,6 +1393,10 @@ and is between 256 and 4096 characters. It is defined in the file
    instruction doesn't work correctly and not to
    use it.

    + no_file_caps Tells the kernel not to honor file capabilities. The
    + only way then for a file to be executed with privilege
    + is to be setuid root or executed by root.
    nohalt [IA-64] Tells the kernel not to use the power saving
    function PAL_HALT_LIGHT when idle. This increases
    power-consumption. On the positive side, it reduces
    diff --git a/include/linux/capability.h b/include/linux/capability.h
    index 9d1fe30..5bc145b 100644
    --- a/include/linux/capability.h
    +++ b/include/linux/capability.h
    @@ -68,6 +68,9 @@ typedef struct __user_cap_data_struct {
    #define VFS_CAP_U32 VFS_CAP_U32_2

    +extern int file_caps_enabled;

    struct vfs_cap_data {
    __le32 magic_etc; /* Little endian */
    diff --git a/kernel/capability.c b/kernel/capability.c
    index 33e51e7..e13a685 100644
    --- a/kernel/capability.c
    +++ b/kernel/capability.c
    @@ -33,6 +33,17 @@ EXPORT_SYMBOL(__cap_empty_set);

    +int file_caps_enabled = 1;
    +static int __init file_caps_disable(char *str)
    + file_caps_enabled = 0;
    + return 1;
    +__setup("no_file_caps", file_caps_disable);
    * More recent versions of libcap are available from:
    diff --git a/security/commoncap.c b/security/commoncap.c
    index e4c4b3f..5f1fec0 100644
    --- a/security/commoncap.c
    +++ b/security/commoncap.c
    @@ -279,6 +279,11 @@ static int get_file_caps(struct linux_binprm *bprm)
    struct vfs_cap_data vcaps;
    struct inode *inode;

    + if (!file_caps_enabled) {
    + bprm_clear_caps(bprm);
    + return 0;
    + }
    if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) {
    return 0;

     \ /
      Last update: 2008-09-27 04:33    [W:0.025 / U:91.316 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site