Messages in this thread | | | Subject | Re: [RFC 17/20] ima: Use integrity_admin_ns_capable() to check corresponding capability | From | James Bottomley <> | Date | Thu, 02 Dec 2021 07:33:01 -0500 |
| |
On Thu, 2021-12-02 at 07:16 +0000, Denis Semakin wrote: > Obviously the main goal by adding new capability was to avoid the > using CAP_SYS_ADMIN (IOW superuser)
OK, but as I've said a couple of times now: the check for CAP_SYS_ADMIN doesn't have to be monolithic like this. We have two sets of checks in the kernel: capable(..., CAP_SYS_ADMIN) which is for the global monolithic root like capability and ns_capable(..., CAP_SYS_ADMIN) which is for the owner (possibly unprivileged) of the user namespace.
This gives us a way of parsing out admin capabilites into the small subset that the user namespace needs. Patch 16 changed the check from capable to ns_capable, meaning it's no longer the monolithic CAP_SYS_ADMIN.
> to manage IMA stuff, that was also about security granularity. It's > good if CAP_MAC_ADMIN will be enough for doing IMA related things > (write policies and extended attributes).
To be honest, as long as the check resolves to ns_capable(..., CAP_SYS_<SOMETHING>) I'm not that bothered because the owner of the user namespace will still pass the check.
> But for me it's a little bit unclear how to deal with unprivileged > users: assuming there's no CAP_INTEGRITY_ADMIN but CAP_MAC_ADMIN was > set up, so in this case user can control any LSM (seLinux, SMACK, > etc) and IMA (policies, xattrs). What if .. for some systems there > would be some requirements that will allow to touch LSM but do not > change any IMA (integrity) things? A user can set up any IMA policy > (it's about the system integrity), modify IMA related xattrs but it's > forbidden to change seLinux policies and e.g. SMACK labels... May be > it's unreal scenario of course... but I guess it's not 100% > impossible.
This is why looking at it as a switch from capable to ns_capable is useful: an ordinary user can assume ns_capable(..., CAP_SYS_ADMIN) powers arbitrarily, so its a significant check on where you can make the switch.
James
| |