[PATCH 0/3] replace suid with capabilities, for example in busybox

[Patrick Ohly <patrick.ohly@intel.com>]

I started working on hardening a distro by replacing suid binaries
with executables that add only the necessary capabilities via file
capabilities.  It is understood that this is often still a path
towards privilege escalation (see
https://forums.grsecurity.net/viewtopic.php?f=7&t=2522&sid=c6fbcf62fd5d3472562540a7e608ce4e#p10271)
but as part of a defense-in-depth strategy it's still useful.

I'd like to get the first two patches reviewed and, if seen as useful,
merged into master.

The busybox_%.bbappend is just an example how this would be used. It's
not meant to be merged.

There's currently one caveat: the file capabilities do not get copied
into images. I see them under pseudo (with getcap, filecap and as
security.capability xattr with getfattr), but they do not get copied
into an ext4 image by mkfs.ext4.

Robert, I tried that with the patched e2fsprogs from meta-selinux. Is
that perhaps something you can look into as part of
https://bugzilla.yoctoproject.org/show_bug.cgi?id=8622 ?

Actually, I just noticed another problem with that e2fsprogs version:
with Smack enabled via meta-intel-iot-security/meta-security-smack,
/etc has under pseudo:
  # getfattr -d -m . rootfs/etc/
  # file: ../rootfs/etc/
  security.SMACK64="System::Shared"
  security.SMACK64TRANSMUTE="TRUE"

A loop-mounted ext4 image only has one xattr:
  security.SMACK64TRANSMUTE="TRUE"

The following changes since commit 192da885e92d3b163b9c4e6b8151c9ecc6062b14:

  build-appliance-image: Update to master head revision (2015-12-09 08:49:13 +0000)

are available in the git repository at:

  git://github.com/pohly/openembedded-core capabilities
  https://github.com/pohly/openembedded-core/tree/capabilities

Patrick Ohly (3):
  capabilities.bbclass: add file capabilities automatically
  busybox.inc: prepare for additional link files
  busybox_%.bbappend: run ping and traceroute with file capabilities

 meta/classes/capabilities.bbclass            | 58 ++++++++++++++++++++++++++++
 meta/recipes-core/busybox/busybox.inc        | 16 ++++----
 meta/recipes-core/busybox/busybox_%.bbappend | 41 ++++++++++++++++++++
 3 files changed, 108 insertions(+), 7 deletions(-)
 create mode 100644 meta/classes/capabilities.bbclass
 create mode 100644 meta/recipes-core/busybox/busybox_%.bbappend

-- 
2.1.4