[PATCH 1/2] file capabilities: add no_file_caps switch (v2)

[PATCH 1/2] file capabilities: add no_file_caps switch (v2)

[Serge Hallyn]

Add a no_file_caps boot option when file capabilities are
compiled into the kernel (CONFIG_SECURITY_FILE_CAPABILITIES=y).

This allows distributions to ship a kernel with file capabilities
compiled in, without forcing users to use (and understand and
trust) them.

When no_file_caps is specified at boot, then when a process executes
a file, any file capabilities stored with that file will not be
used in the calculation of the process' new capability sets.

This means that booting with the no_file_caps boot option will
not be the same as booting a kernel with file capabilities
compiled out - in particular a task with  CAP_SETPCAP will not
have any chance of passing capabilities to another task (which
isn't "really" possible anyway, and which may soon by killed
altogether by David Howells in any case), and it will instead
be able to put new capabilities in its pI.  However since fI
will always be empty and pI is masked with fI, it gains the
task nothing.

We also support the extra prctl options, setting securebits and
dropping capabilities from the per-process bounding set.

The other remaining difference is that killpriv, task_setscheduler,
setioprio, and setnice will continue to be hooked.  That will
be noticable in the case where a root task changed its uid
while keeping some caps, and another task owned by the new uid
tries to change settings for the more privileged task.

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
---
 include/linux/capability.h |    4 ++++
 kernel/capability.c        |   11 +++++++++++
 security/commoncap.c       |    9 +++++++++
 3 files changed, 24 insertions(+), 0 deletions(-)

diff --git a/include/linux/capability.h b/include/linux/capability.h
index 9d1fe30..c96c455 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -359,6 +359,10 @@ typedef struct kernel_cap_struct {
 
 #ifdef __KERNEL__
 
+#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
+extern int file_caps_enabled;
+#endif
+
 /*
  * Internal kernel functions only
  */
diff --git a/kernel/capability.c b/kernel/capability.c
index 33e51e7..e13a685 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -33,6 +33,17 @@ EXPORT_SYMBOL(__cap_empty_set);
 EXPORT_SYMBOL(__cap_full_set);
 EXPORT_SYMBOL(__cap_init_eff_set);
 
+#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
+int file_caps_enabled = 1;
+
+static int __init file_caps_disable(char *str)
+{
+	file_caps_enabled = 0;
+	return 1;
+}
+__setup("no_file_caps", file_caps_disable);
+#endif
+
 /*
  * More recent versions of libcap are available from:
  *
diff --git a/security/commoncap.c b/security/commoncap.c
index e4c4b3f..e33f632 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -27,6 +27,10 @@
 #include <linux/prctl.h>
 #include <linux/securebits.h>
 
+#ifndef CONFIG_SECURITY_FILE_CAPABILITIES
+static const int file_caps_enabled;
+#endif
+
 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
 {
 	NETLINK_CB(skb).eff_cap = current->cap_effective;
@@ -279,6 +283,11 @@ static int get_file_caps(struct linux_binprm *bprm)
 	struct vfs_cap_data vcaps;
 	struct inode *inode;
 
+	if (!file_caps_enabled) {
+		bprm_clear_caps(bprm);
+		return 0;
+	}
+
 	if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) {
 		bprm_clear_caps(bprm);
 		return 0;
-- 
1.5.4.3

[PATCH 2/2] file capabilities: turn on by default

[Serge Hallyn]

Now that file capabilities can be turned off at boot, go ahead
and compile them into the kernel by default by making
CONFIG_SECURITY_FILE_CAPABILITIES=y the default.

Note that the boot flag no_file_caps must be specified to turn
file capabilities off, as by default they are on.  So the
default behavior is in fact changed.

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
---
 security/Kconfig |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/security/Kconfig b/security/Kconfig
index 5592939..6fbb233 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -75,12 +75,15 @@ config SECURITY_NETWORK_XFRM
 
 config SECURITY_FILE_CAPABILITIES
 	bool "File POSIX Capabilities"
-	default n
+	default y
 	help
 	  This enables filesystem capabilities, allowing you to give
 	  binaries a subset of root's powers without using setuid 0.
 
-	  If in doubt, answer N.
+	  You can still boot with the no_file_caps option to disable
+	  file capabilities.
+
+	  If in doubt, answer Y.
 
 config SECURITY_ROOTPLUG
 	bool "Root Plug Support"
-- 
1.5.4.3

Re: [PATCH 1/2] file capabilities: add no_file_caps switch (v2)

[Andrew G. Morgan]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Acked-by: Andrew G. Morgan <morgan@kernel.org>

Cheers

Andrew

Serge Hallyn wrote:
| Add a no_file_caps boot option when file capabilities are
| compiled into the kernel (CONFIG_SECURITY_FILE_CAPABILITIES=y).
|
| This allows distributions to ship a kernel with file capabilities
| compiled in, without forcing users to use (and understand and
| trust) them.
|
| When no_file_caps is specified at boot, then when a process executes
| a file, any file capabilities stored with that file will not be
| used in the calculation of the process' new capability sets.
|
| This means that booting with the no_file_caps boot option will
| not be the same as booting a kernel with file capabilities
| compiled out - in particular a task with  CAP_SETPCAP will not
| have any chance of passing capabilities to another task (which
| isn't "really" possible anyway, and which may soon by killed
| altogether by David Howells in any case), and it will instead
| be able to put new capabilities in its pI.  However since fI
| will always be empty and pI is masked with fI, it gains the
| task nothing.
|
| We also support the extra prctl options, setting securebits and
| dropping capabilities from the per-process bounding set.
|
| The other remaining difference is that killpriv, task_setscheduler,
| setioprio, and setnice will continue to be hooked.  That will
| be noticable in the case where a root task changed its uid
| while keeping some caps, and another task owned by the new uid
| tries to change settings for the more privileged task.
|
| Signed-off-by: Serge Hallyn <serue@us.ibm.com>
| ---
|  include/linux/capability.h |    4 ++++
|  kernel/capability.c        |   11 +++++++++++
|  security/commoncap.c       |    9 +++++++++
|  3 files changed, 24 insertions(+), 0 deletions(-)
|
| diff --git a/include/linux/capability.h b/include/linux/capability.h
| index 9d1fe30..c96c455 100644
| --- a/include/linux/capability.h
| +++ b/include/linux/capability.h
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFIt0Qi+bHCR3gb8jsRApyoAKC4brJOkrqsna3iDQ8xMFEPlyAW/wCbBHy+
xUaMSRInmcgNkYdoNJkxzOQ=
=zTib
-----END PGP SIGNATURE-----

Re: [PATCH 2/2] file capabilities: turn on by default

[Andrew G. Morgan]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Acked-by: Andrew G. Morgan <morgan@kernel.org>

Cheers

Andrew

Serge Hallyn wrote:
| Now that file capabilities can be turned off at boot, go ahead
| and compile them into the kernel by default by making
| CONFIG_SECURITY_FILE_CAPABILITIES=y the default.
|
| Note that the boot flag no_file_caps must be specified to turn
| file capabilities off, as by default they are on.  So the
| default behavior is in fact changed.
|
| Signed-off-by: Serge Hallyn <serue@us.ibm.com>
| ---
|  security/Kconfig |    7 +++++--
|  1 files changed, 5 insertions(+), 2 deletions(-)
|
| diff --git a/security/Kconfig b/security/Kconfig
| index 5592939..6fbb233 100644
| --- a/security/Kconfig
| +++ b/security/Kconfig
| @@ -75,12 +75,15 @@ config SECURITY_NETWORK_XFRM
|
|  config SECURITY_FILE_CAPABILITIES
|  	bool "File POSIX Capabilities"
| -	default n
| +	default y
|  	help
|  	  This enables filesystem capabilities, allowing you to give
|  	  binaries a subset of root's powers without using setuid 0.
|
| -	  If in doubt, answer N.
| +	  You can still boot with the no_file_caps option to disable
| +	  file capabilities.
| +
| +	  If in doubt, answer Y.
|
|  config SECURITY_ROOTPLUG
|  	bool "Root Plug Support"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFIt0Sp+bHCR3gb8jsRAmQuAKDXiLp/7hZ++JDxv1rL1kIVqS/YtgCeJIMk
zmPFh8NjFrUnElWyeF5R/Jo=
=AK55
-----END PGP SIGNATURE-----

[PATCH 2/2] file capabilities: turn on by default

[Serge E. Hallyn]

Now that file capabilities can be turned off at boot, go ahead
and compile them into the kernel by default by making
CONFIG_SECURITY_FILE_CAPABILITIES=y the default.

Note that the boot flag no_file_caps must be specified to turn
file capabilities off, as by default they are on.  So the
default behavior is in fact changed.

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
---
 security/Kconfig |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/security/Kconfig b/security/Kconfig
index 5592939..6fbb233 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -75,12 +75,15 @@ config SECURITY_NETWORK_XFRM
 
 config SECURITY_FILE_CAPABILITIES
 	bool "File POSIX Capabilities"
-	default n
+	default y
 	help
 	  This enables filesystem capabilities, allowing you to give
 	  binaries a subset of root's powers without using setuid 0.
 
-	  If in doubt, answer N.
+	  You can still boot with the no_file_caps option to disable
+	  file capabilities.
+
+	  If in doubt, answer Y.
 
 config SECURITY_ROOTPLUG
 	bool "Root Plug Support"
-- 
1.5.4.3

Re: [PATCH 2/2] file capabilities: turn on by default

[Randy Dunlap]

On Mon, 22 Sep 2008 13:49:01 -0500 Serge E. Hallyn wrote:

> 
> Now that file capabilities can be turned off at boot, go ahead
> and compile them into the kernel by default by making
> CONFIG_SECURITY_FILE_CAPABILITIES=y the default.

Hi,

How much code does this add to everyone's kernel?

> Note that the boot flag no_file_caps must be specified to turn
> file capabilities off, as by default they are on.  So the
> default behavior is in fact changed.

If most people want this enable, using 'no_file_caps' makes
some sense.  OTOH, if most people don't want/use it, then
having a 'file_caps_on' option would make more sense.

Do you have any (unbiased :) ideas about this?

Thanks.

> Signed-off-by: Serge Hallyn <serue@us.ibm.com>
> Acked-by: Andrew G. Morgan <morgan@kernel.org>
> ---
>  security/Kconfig |    7 +++++--
>  1 files changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/security/Kconfig b/security/Kconfig
> index 5592939..6fbb233 100644
> --- a/security/Kconfig
> +++ b/security/Kconfig
> @@ -75,12 +75,15 @@ config SECURITY_NETWORK_XFRM
>  
>  config SECURITY_FILE_CAPABILITIES
>  	bool "File POSIX Capabilities"
> -	default n
> +	default y
>  	help
>  	  This enables filesystem capabilities, allowing you to give
>  	  binaries a subset of root's powers without using setuid 0.
>  
> -	  If in doubt, answer N.
> +	  You can still boot with the no_file_caps option to disable
> +	  file capabilities.
> +
> +	  If in doubt, answer Y.
>  
>  config SECURITY_ROOTPLUG
>  	bool "Root Plug Support"


---
~Randy

Re: [PATCH 2/2] file capabilities: turn on by default

[Serge E. Hallyn]

Quoting Randy Dunlap (randy.dunlap@oracle.com):
> On Mon, 22 Sep 2008 13:49:01 -0500 Serge E. Hallyn wrote:
> 
> > 
> > Now that file capabilities can be turned off at boot, go ahead
> > and compile them into the kernel by default by making
> > CONFIG_SECURITY_FILE_CAPABILITIES=y the default.
> 
> Hi,
> 
> How much code does this add to everyone's kernel?

Here are the sizes I get with Linus' plain tree and patched
with both of these patches:

master  with file capabilities: 6241626
master  w/o  file capabilities: 6241595

patched with file capabilities: 6241782
patched w/o  file capabilities: 6241595

So actually I don't like the added size.

> > Note that the boot flag no_file_caps must be specified to turn
> > file capabilities off, as by default they are on.  So the
> > default behavior is in fact changed.
> 
> If most people want this enable, using 'no_file_caps' makes
> some sense.  OTOH, if most people don't want/use it, then
> having a 'file_caps_on' option would make more sense.
> 
> Do you have any (unbiased :) ideas about this?

I'll sit this one out I guess :)

> Thanks.
> 
> > Signed-off-by: Serge Hallyn <serue@us.ibm.com>
> > Acked-by: Andrew G. Morgan <morgan@kernel.org>
> > ---
> >  security/Kconfig |    7 +++++--
> >  1 files changed, 5 insertions(+), 2 deletions(-)
> > 
> > diff --git a/security/Kconfig b/security/Kconfig
> > index 5592939..6fbb233 100644
> > --- a/security/Kconfig
> > +++ b/security/Kconfig
> > @@ -75,12 +75,15 @@ config SECURITY_NETWORK_XFRM
> >  
> >  config SECURITY_FILE_CAPABILITIES
> >  	bool "File POSIX Capabilities"
> > -	default n
> > +	default y
> >  	help
> >  	  This enables filesystem capabilities, allowing you to give
> >  	  binaries a subset of root's powers without using setuid 0.
> >  
> > -	  If in doubt, answer N.
> > +	  You can still boot with the no_file_caps option to disable
> > +	  file capabilities.
> > +
> > +	  If in doubt, answer Y.
> >  
> >  config SECURITY_ROOTPLUG
> >  	bool "Root Plug Support"
> 
> 
> ---
> ~Randy

Re: [PATCH 2/2] file capabilities: turn on by default

[Randy Dunlap]

Serge E. Hallyn wrote:
> Quoting Randy Dunlap (randy.dunlap@oracle.com):
>> On Mon, 22 Sep 2008 13:49:01 -0500 Serge E. Hallyn wrote:
>>
>>> Now that file capabilities can be turned off at boot, go ahead
>>> and compile them into the kernel by default by making
>>> CONFIG_SECURITY_FILE_CAPABILITIES=y the default.
>> Hi,
>>
>> How much code does this add to everyone's kernel?
> 
> Here are the sizes I get with Linus' plain tree and patched
> with both of these patches:
> 
> master  with file capabilities: 6241626
> master  w/o  file capabilities: 6241595
> 
> patched with file capabilities: 6241782
> patched w/o  file capabilities: 6241595
> 
> So actually I don't like the added size.
> 
>>> Note that the boot flag no_file_caps must be specified to turn
>>> file capabilities off, as by default they are on.  So the
>>> default behavior is in fact changed.
>> If most people want this enable, using 'no_file_caps' makes
>> some sense.  OTOH, if most people don't want/use it, then
>> having a 'file_caps_on' option would make more sense.
>>
>> Do you have any (unbiased :) ideas about this?
> 
> I'll sit this one out I guess :)

BTW, I like Stephen's suggestion of using file_caps=0/1 instead
of no_file_caps.

-- 
~Randy

Re: [PATCH 2/2] file capabilities: turn on by default

[Chris Wright]

* Serge E. Hallyn (serue@us.ibm.com) wrote:
> Here are the sizes I get with Linus' plain tree and patched
> with both of these patches:
> 
> master  with file capabilities: 6241626
> master  w/o  file capabilities: 6241595
> 
> patched with file capabilities: 6241782
> patched w/o  file capabilities: 6241595
> 
> So actually I don't like the added size.

Different than I'm seeing here (note: defconfig has file capabilities):

   text	   data	    bss	    dec	    hex	filename
6804621	1017960	 671900	8494481	 819d91	obj64-defconfig/vmlinux
6804642	1017984	 671900	8494526	 819dbe	obj64-defconfig-patch/vmlinux
6804069	1017960	 671900	8493929	 819b69	obj64-nofcap/vmlinux
6804068	1017960	 671900	8493928	 819b68	obj64-nofcap-patch/vmlinux

thanks,
-chris