Re: filesystem capabilities

[Kees Cook <kees () ubuntu com>]

On Mon, Nov 08, 2010 at 12:01:29PM -0500, Steve Grubb wrote:
> > While in general this is a good idea, there are issues with it, 
> > in arbitrary order:
> >
> > - Some currently-SUID programs are aware of them being (potentially) SUID, and 
> > will drop the "more privileged" euid when it is no longer needed, but they will
> > probably not be aware of them possessing capabilities.
>
> This is an artifact of having a capabilities library that takes several lines of code 
> to do anything. It is more correct to check for capabilities that trusting that euid 
> means that you have certain powers. In my opinion, a lot of this code should be 
> cleaned up so that its correct.

Right, it's not just a matter of dropping setuid bits and adding fscaps;
these tools each need to be changed to understand fscaps and correctly drop
privs. Which is especially true for "mixed" environments where the code
could run _either_ as setuid or with fscaps. Building that logic into the
cap library (which ever one) is the plan, as I understand.

> The intent of this project is to get the patches and user space work done. We know 
> that just setting the bit is not all that has to be done.

Yup, and Debian and Ubuntu have even further to go since their userspace
and package manager don't even handle xattrs. It would be nice if upstream
tar took the xattr patches. Steve, are there any plans to make that happen?

-Kees

-- 
Kees Cook
Ubuntu Security Team