Re: patch to make Linux capabilities into something useful (v 0.3.1)

[David Madore <david.madore@ens.fr>]

On Thu, Sep 07, 2006 at 12:12:15AM +0000, Casey Schaufler wrote:
> You have not introduced new capabilities
> so much as you've introduced a new layer of
> policy, that being things that unprivileged
> processes can do but that "underprivileged"
> processes cannot. I personally think that
> this would make a spiffy LSM, but I don't
> buy it as an extension of the POSIX (draft)
> capability mechanism. Why? Because the
> capability mechanism deals with providing
> controls over the abilty to violate the
> traditional Unix security policy, as
> implemented in Linux. Adding "negative"
> privilege might not be a bad idea, but
> it is outside the scope of capabilities
> AND there is a mechanism (LSM) explicity
> in place for adding such restrictions.

I understand your point.  But if we want these under-privileges to
follow the same inheritance rules as the over-privileges provided by
capabilities (were it only to make things simpler to comprehend),
doesn't it make sense to implement them in the same framework?  Rather
than trying to reproduce the same rules in a different part of the
kernel, causing code reduplication which would eventually, inevitably,
fall out of sync...  I think it's easier for everyone if under- and
over-privileges are treated in a uniform fashion.  Perhaps that's not
what POSIX intended, but I don't think "not what was intended" is a
sufficient reason for backing away from something that might be
useful.  Do you have a specific problem in mind?

However, the suggestion makes sense: if I can't convince the Powers
That Be that implementing under-privileges with capabilities is a Good
Thing (and I can see that it will be a serious problem), I'll try the
LSM approach.

-- 
     David A. Madore
    (david.madore@ens.fr,
     http://www.madore.org/~david/ )