Re: [PATCH] capabilities: do not audit log BPRM_FCAPS on set*id

[Steve Grubb <sgrubb@redhat.com>]

On Tuesday, March 7, 2017 4:10:49 PM EST Richard Guy Briggs wrote:
> > > > > one possibly audit-worth case which (if I read correctly) this will
> > > > > skip is where a setuid-root binary has filecaps which *limit* its
> > > > > privs.
> > > > > Does that matter?
> > > > 
> > > > I hadn't thought of that case, but I did consider in the setuid case
> > > > comparing before and after without setuid forcing the drop of all
> > > > capabilities via "ambient".  Mind you, this bug has been around before
> > > > Luto's patch that adds the ambient capabilities set.
> > > 
> > > Can you suggest a scenario where that might happen?
> > 
> > Sorry, do you mean the case I brought up, or the one you mentioned?  I
> > don't quite understnad the one you brought up.  For mine it's pretty
> > simple to reproduce, just
> 
> I was talking about the case you brought up, but they could be the same
> case.
> 
> I was thinking of a case where the caps actually change, but are
> overridden by the blanket full permissions of setuid.

If there actually is a change in capability bits besides the implied change of 
capabilities based on the change of the uid alone, then it should be logged.

-Steve