Messages in this thread | | | Date | Thu, 5 Nov 2015 11:34:38 -0600 | From | "Serge E. Hallyn" <> | Subject | Re: [KERNEL] Re: [KERNEL] Re: [KERNEL] Re: Kernel 4.3 breaks security in systems using capabilities |
| |
On Thu, Nov 05, 2015 at 06:17:01PM +0100, Klaus Ethgen wrote: > Hi Serge, > > Am Do den 5. Nov 2015 um 17:15 schrieb Serge E. Hallyn: > > I think if you follow your idea to its logical conclusions, you end > > up wanting set SECURE_ALL_BITS | SECURE_ALL_LOCKS, which will include > > SECURE_NO_CAP_AMBIENT_RAISE, disabling ambient capabilities. > > That I did miss out and seems to be the solution for the problem. So > adding cap_secure_all_bits,cap_secure_all_locks=ep to every binary that > gets other caps should solve it?
No that doesn't work, you have to use prctl to set those bits. If you can get your system to be fully rootless, you can have init or initramfs do this for you. It'll mean that root and setuid-root binaries have no automatic privileges beside owning host (proc/sys) files.
| |