Re: [PATCH -v2] capabilites: allow the application of capability limits to usermode helpers

[Eric Paris <eparis@redhat.com>]

On Wed, 2011-03-09 at 22:45 +0300, Vasiliy Kulikov wrote:
> Eric,
> 
> On Wed, Mar 09, 2011 at 14:33 -0500, Eric Paris wrote:
> > someone complained that any user with
> > cap_net_admin was able to load arbitrary kernel modules, even though the user
> > didn't have cap_sys_module.  The reason is because the actual load is done by
> > a usermode helper and those always have the full cap set.
> 
> AFAIU, your patch sets system-wide caps for _all_ usermode helpers,
> right?  Then it does nothing with cap_net_admin's problem as it should
> restrict caps of specific helpers spawned from specific networking code,
> but not touching anything related to another helpers.

I'm actually solving 2 problems at once and it just so happens the the
CAP_NET_ADMIN brew-ha-ha came up more recently.  The original problem,
and reason I wrote this patch, is because it's impossible on a modern
Linux system to permanently and irrevocably drop capabilities system
wide.  You can get very close by dropping capabilities from the bset
before init is launched which means everything launched by userspace
can't have the dropped capabilities.  But, khelper is still going to
have the full set and thus usermodehelpers launched by the kernel will
have the full set.  This patch allows one to control usermode helpers.
How one chooses to use that, is up to them.

-Eric