Re: [PATCH 0/4] MultiAdmin LSM

Arjan van de Ven
2006-05-01T13:50:59Z

> 2. A small problem
> ==================
> As cool as it may sound, I think the implementation is not as clean as
> possible.
>
> Let's pick a random starting point: The subadmin is allowed to call
> drivers/char/lp.c:lp_ioctl():LPGETSTATS. Or
> fs/quota.c:generic_quotactl_valid():Q_GET*/Q_XGET*. For that to work
> without too much code changes, CAP_SYS_ADMIN must be given to the
> subadmin.
>
> However, CAP_SYS_ADMIN (others are affected too, but this is the main one)
> is used for other things too (mostly write or ioctl operations), which is
> actually something that should not be granted to the subadmin.
>
> This poses a problem. Currently, it is solved by adding an extra LSM hook,
> security_cap_extra(), called from capable(). The hooked function then
> looks at current->*uid/*gid and returns 1 or 0, depending on whether an
> action is allowed or not. For more details see patch #1.
>
>

I wonder if we should just split up CAP_SYS_ADMIN then...
that might end up being the most simple solution...