Re: Privileged File Access from Desktop Applications

["Perry E. Metzger" <perry () piermont com>]

On Fri, 12 Jul 2019 11:53:26 -0400 "Perry E. Metzger"
<perry () piermont com> wrote:
> > > What's the right way to handle this stuff? Capabilities,
> > > probably. It's what they're designed for.
> >
> > They're completely not designed for this case. Setting
> > CAP_DAC_OVERRIDE or CAP_SYS_ADMIN is very close to SUID root. See:
> > https://grsecurity.net/false_boundaries_and_arbitrary_code_execution.php
>
> Those aren't capabilities. Those are this POSIX mechanism that got
> the same name for no good reason and doesn't do anything like what
> an actual capability system does.

It occurs to me that people without a background in computer security
might not know what a capability actually is, or how a capability
based security system manages access control.

This Wikipedia page:
https://en.wikipedia.org/wiki/Capability-based_security
isn't the best, but it does have good pointers to real explanations.

For a look at how you can implement a capability system on top
of Unix, see Capsicum, which was built for FreeBSD but never actually
ported to Linux (which is sad and should be corrected):
https://www.cl.cam.ac.uk/research/security/capsicum/papers/2010usenix-security-capsicum-website.pdf

Note that a primitive form of capabilities can be achieved in the
current Linux kernel by passing file descriptors between processes, a
tool relatively few people seem to know exists. Given that the
"correct" mechanism (something like Capsicum) doesn't exist in Linux
yet, it's a poor man's second best. Again, porting Capsicum would be
the smart thing to do instead of all this ad hoc stuff.


Perry
-- 
Perry E. Metzger                perry () piermont com