Re: [PATCH] [request for inclusion] Realtime LSM

Chris Wright
2005-01-07T17:29:27Z

* Martin Mares (mj@ucw.cz) wrote:
> Hello!
>
> > They are present but disabled by default. You have to hack the initial
> > values of CAP_INIT_EFF_SET and CAP_INIT_IHN_SET.
>
> Oops. Does anybody know why this has been done?

Yes, SETPCAP became a gaping security hole. Recall the sendmail hole.

> Also, it seems that it has a relatively easy work-around: boot with
> init=/sbin/simple-wrapper and let the wrapper set the cap_bset and exec real
> init. (I agree that it's a hack, but a temporarily usable one.)

This won't work, you can't increase the bset, which is hardcoded to
leave out SETPCAP. Also, init is hard coded to start without SETPCAP.

thanks,
-chris
--
Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net