Re: Frustrated with capabilities..

[Theodore Tso <tytso@mit.edu>]

On Thu, Aug 28, 2008 at 05:45:34PM +0300, Markku Savela wrote:
> 
> > From: Pavel Machek <pavel@suse.cz>
> 
> > Yes, you need upcoming filesystem capabilities.  Binary may not
> > inherit capabilities unless filesystem flags permit that.
> 
> I think this is wrong. Normal executables inherit uid/gid and
> supplementary groups by default. Why should capabilities be any
> different?

Well, because that's not the what the POSIX draft specification (and
the rest of the Unix industry who were striving to meet the US
Department of Defense's "B2 by '92" initiative) ended up implementing.

The reason for that was to avoid bugs where a program that wasn't
expecting to be setuid (or just written by a stupid progammer) exec's
some program which wasn't expecting to have root privileges then bad
things happen.  The classic example of this was running the mail
program, which was setuid or setgid to the mail user/group, and then
typing "!/bin/sh" which would exec a shell running with those
privileges (because the mail program didn't know to drop its
privileges).

So in the capabilities model, the capabilities do *not* inherit unless
the a particular file explicitly states that it should inherit the
capabilities.  It's the principle of least privilege taken to its
logical conclusion.

						- Ted