Re: patch to make Linux capabilities into something useful (v 0.3.1)

[daw@cs.berkeley.edu (David Wagner)]

David Madore  wrote:
>On Fri, Sep 08, 2006 at 12:54:29AM +0200, Pavel Machek wrote:
>>		      Alternatively disallow suid/sgid-anything exec
>> when all "usual" capabilities are not present.
>
>This is probably too stringent: remove any trivial capability
>whatsoever and you lose a rather important ability.

This might not be so terrible.  At least, I'm not sure I'd rule it
out at this point -- it seems like it might be worth considering.

First of all, if you have intentionally created an underprivileged
process, it seems almost reasonable to think that you might not want
that process to be able to exec anything that is suid/sgid.

Second, there are very few programs out there that are sgid or
suid-to-something-other-than-root.  On my FC5 machine, the ones I can spot
are ssh-agent, locate, screen, sendmail, postfix, a bunch of games, and a
few other random programs that are probably very rarely used.  I'm having
a hard time imagining a use case where I'd want an underprivileged daemon
to be able to exec one of those programs.  Normally, if I'm running
one of those programs, I'm probably doing it from a command-line shell
(which will have full user privileges) or some other environment that
is running with full user privileges (e.g., startup scripts or login
scripts, in the case of ssh-agent).