Re: [capabilities] Allow normal inheritance for a configurable set of capabilities

Christoph Lameter
2015-02-03T23:14:10Z

On Tue, 3 Feb 2015, Andy Lutomirski wrote:

> > */
> > new->cap_permitted.cap[i] =
> > (new->cap_bset.cap[i] & permitted) |
> > - (new->cap_inheritable.cap[i] & inheritable);
> > + (new->cap_inheritable.cap[i] & inheritable) |
> > + (ambient & inheritable);
>
> Is there a clear reason why no non-permitted bits can be inheritable?
> If not, then I think this should be (ambient & inheritable &
> permitted).

Inherited caps via ambient are always be permitted. Otherwise the pass
through is not working.

> Do we need to think about the effective mask here? What happens when
> we exec a setuid program or a program with a non-empty fP set? I
> think that, in these cases, we should strongly consider clearing the
> ambient set. For a different approach, see below.
>
> >
> > if (permitted & ~new->cap_permitted.cap[i])
> > /* insufficient to execute correctly */
> > ret = -EPERM;
> > +
> > + if (capable(CAP_AMBIENT_MASK))
> > + new->cap_ambient.cap[i] = inheritable;
> > + else
> > + new->cap_ambient.cap[i] = ambient;
>
> IMO this is really weird. I don't think that the presence of an
> effective cap should change the cap equations. (Also, that should be
> nsown_capable.)

Well how would the ambient mask to be set? The other options are adding a
new syscall and having to go through an interation of the capabilities
tools and/or kernel syscall API changes.

> Can we please make this an explicit opt-in? For example, allow a
> process to set an ambient cap bit if that bit is both permitted and
> inheritable. I'd prefer having it be a single control, though -- just
> prctl(PR_SET_ALWAYS_INHERIT_CAPS, 1, 0, 0, 0) would set a single bit
> that would cause all inheritable bits to be treated as ambient.

Opt-in does not work since the caps need to be passed
through binaries that do not use the capabilities.

> Here's a slight variant that might be more clearly safe: add an
> inherited per-process bit that causes all files to act as though fI is
> the full set. Only allow setting that bit if no_new_privs is set.

CAP_INHERIT_ALL ?