From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751443AbdJWMwz (ORCPT ); Mon, 23 Oct 2017 08:52:55 -0400 Received: from ucol19pa10.eemsg.mail.mil ([214.24.24.83]:47164 "EHLO UCOL19PA10.eemsg.mail.mil" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750835AbdJWMwx (ORCPT ); Mon, 23 Oct 2017 08:52:53 -0400 X-IronPort-AV: E=Sophos;i="5.43,422,1503360000"; d="scan'208";a="361007800" X-IronPort-AV: E=Sophos;i="5.43,422,1503360000"; d="scan'208";a="5016825" IronPort-PHdr: =?us-ascii?q?9a23=3AT1PRoRZcUh+goe48M5zkcR//LSx+4OfEezUN459i?= =?us-ascii?q?sYplN5qZpc6zbB7h7PlgxGXEQZ/co6odzbGH4+a4ASQp2tWoiDg6aptCVhsI24?= =?us-ascii?q?09vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6nK94iQPFRrhKAF7?= =?us-ascii?q?Ovr6GpLIj8Swyuu+54Dfbx9GiTe5Yr5+Ngm6oRnMvcQKnIVuLbo8xAHUqXVSYe?= =?us-ascii?q?RWwm1oJVOXnxni48q74YBu/SdNtf8/7sBMSar1cbg2QrxeFzQmLns65Nb3uhnZ?= =?us-ascii?q?TAuA/WUTX2MLmRdVGQfF7RX6XpDssivms+d2xSeXMdHqQb0yRD+v9LlgRgP2hy?= =?us-ascii?q?gbNj456GDXhdJ2jKJHuxKquhhzz5fJbI2JKPZye6XQct0ARWpFQ81fSSpPDI2h?= =?us-ascii?q?ZIcLFuYNI/pUo4z7qlATrxWxGBOsCfvsxDFVhnH4w6M03OYvEQHBwAMuGN0Bvn?= =?us-ascii?q?vPodXpN6ofS/y5wbPUwTjBaf5dxDfz6JLPchAkufyCQK5wftTJyUkvCQzFiEib?= =?us-ascii?q?p5HgPzyP0uQNt3aU7up9Xu+okG4othpxryOzxsYslobJhoUVxkrC9SVi2ok5P9?= =?us-ascii?q?K4SEllYdO9FpZbqiKUN5NuT88/TGxltzw2x70btZKhYiQHx4orywTCZ/GBboOG?= =?us-ascii?q?+AjsVPyLLjd9nH9lfbW/iAus/kW40e38U9W00E5NripYjtnArnAN2ALX6siAUv?= =?us-ascii?q?Z94l2u2SyO1wDO8eFIO1w0lKrHJJ4hxb48jJwTvljYHiDqgkn2ia6WdkE89uip?= =?us-ascii?q?7eTofKnmq4eBO4J7hQzyKKQjltGlDegmPQUCQXKX9fmk2L3m50L5QbFKjvMskq?= =?us-ascii?q?netZDXPd8bqbOiAwJOzoYi6wqwDzeh0NgCm3kHN0hKdAiIj4juJVHCOOr4Auun?= =?us-ascii?q?g1SwjDdrwOjLPr7/DZXXKHjMjrPhca9960FG0go80M5Q55RVCrEHL/L+QUvxtN?= =?us-ascii?q?3DDh8lKAy42eHnCM1j2YMYV2OAGKuZMKfIvVCU4eIvJvGGZJUJtzblN/gl+/nu?= =?us-ascii?q?gGc9mV8ce6mpwJQWZGmiEfR+IkWUemTsgtgfHmcQpAY+T/LliEeEUTFNY3a+Ra?= =?us-ascii?q?U85is0CIi+F4fMWpitgKCd3Ce8BpBWYmFGClaREXbnbomEQOkDZz6PIs97kzwE?= =?us-ascii?q?SbigR5Yk1RGpqQD61r5nIfTP9y0GupLsysJ16/fQlR4s7zx0CdqS02WXQ2FzhG?= =?us-ascii?q?MISCc83Lpjrkxl1leDza94juRcFdxS4fNJTwg7OYfSz+xhFt/9RBzBccmNSFu9?= =?us-ascii?q?XNWmDi8+Tsgrz98NfUl9AdOigQ7H3yawBL8VjbOLDoQu8q3Ax3jxO9p9y3He2a?= =?us-ascii?q?kljlkmRNZPNGK/iqFh+AnTG4HEnl6Hl6ala6scxjTB9GSdwmqUukFXTgpwXb/C?= =?us-ascii?q?XXAFaUvctc756V/aT7+yFbQnNRNMycqDKqtMd93ogkxKRPT9N9TEZWK+hWOwCA?= =?us-ascii?q?2WxrODcoXqYX8R3CbDB0gelQAc43KGORI5Bie7rGLUFCZuGk73Y0Pw7el+r2u2?= =?us-ascii?q?Tks1zwGMck1g2KO59QIPivOAS/McwLwEuDw6pjVuAlmywtLWBMCcpwZ7YKpcZt?= =?us-ascii?q?Y96k9d1W3Frwx9IoCgL6d6i14caQt3ul3h1w5tBoVEi8QqqXQqzBBoKaKZy1NM?= =?us-ascii?q?bDSY3YrqNbLLLmn94gqjZLLR2lHbyNyW4LsA6Owkq1X/uwGkDlQt82193NlP0n?= =?us-ascii?q?uc/Y7HDBIIXpLrU0Y37AB6p7XAbSYh+YzYz3psMbO7sjXawdImGPMlygq8f9dY?= =?us-ascii?q?KK6EDBX9E9AeB8W1MOwlgUWpbhYdMOBX8640ONmmeOWc1KG3O+ZgmSqsjX5b74?= =?us-ascii?q?BlzkKM6y18R/bT35kb2fGY0RWIWiz8jFi7tsD3nYBFZTcIEmWjzijkAZZbZrdu?= =?us-ascii?q?coYTFWeuP8q3y81gh57sQX5Y80WuBlIY18+veBqScUbx3QlR1UQRvHymljG0zz?= =?us-ascii?q?tukzEmtKafwS/Oyfz4dBUbIm5LWHVijVD0LIeukt8aXUyobwc3mxu//0r6xLZU?= =?us-ascii?q?pL55L2bNRUdFZDX5L2BmUqu/qLWCedRD548yvi9PSuSzfUiaSqLhoxsdyy7jA2?= =?us-ascii?q?tfxCwgdzGtoZj5mh16iH6HIHltsXXZZNl6xQ3D69zEWf5Rwj0GSTFlhjnXAVi9?= =?us-ascii?q?Mcem/dGQl5fYqe2+TXyuWYBTcSbx0YOMrje05WpvARenhfC8hsXnERQm0S/8z9?= =?us-ascii?q?RqUyTIowr7Yonvzau6KvlqcVJ2C1/47Mp6B4B+ko0qiJEew3hJzqmSqFwGmmD3?= =?us-ascii?q?OM4T86/6a2cMQ3Zfxd/e5wzsw2VpI3aO2oP/EHuHlI8pS9CkY29e+iUi4sROE+?= =?us-ascii?q?/A4LxDgiZxpkGQtw/dYfFh2DwazK1qoDQmg+wOtA03w22hGf8VVwEMIT3wjBOg?= =?us-ascii?q?6tGi6qhbeTDrOZG22FBzlMvpILCGrQxGECLwdpYmEiJqqMZyKlTB1FX/64Xrdc?= =?us-ascii?q?OWZttF8lW9lxrQhu5ZJYh5qPsQgmIzJ2PnulU3xug6k1pq3JenrM6AMWor4aHv?= =?us-ascii?q?RlZjOyf6aosz8zXpnKAWyt2bxY+iNpVoHjEaWt3jSvf+VHoqvOnjfyOJFycx4i?= =?us-ascii?q?ODEKfbNReW9UMjqnXICZ3tPHaScj1R4M9jT1GlLVZem0hAUS0zhJ8iPhij3s36?= =?us-ascii?q?aENw7T1X4UT3/F8E6OttOgK3d2DFvgazImM2QZ2SN1xSqARF/V3UKuSZ9Ot4Gy?= =?us-ascii?q?we9Zqk+kjFLm2dehQNBmgCWkGKHHj5M7Wu7MWG+O+dQqK6Lv3TcfCNpPZYWvOg?= =?us-ascii?q?252iyM1l8iyKO8HJOWNtS7U/20xeTTV0C9iFsysARjZRlC/XacOf4hCm9Wk/qs?= =?us-ascii?q?G57eSuVhnj6JWCD5NMPth1vRO7m6GOM6iXnik9YTJZ0I4cgGTFw6UF3UIDziRp?= =?us-ascii?q?eySpHJweuiPXCqHdgKlaC1gccSw3fNBF66M6wxllJd/QitSz0KVxyPEyFRMNUV?= =?us-ascii?q?3nh9HsbNQLC3+yOUmBB0uRMrmCYzrRzIW/Yq6mT7BUyeVdrRG9vzedHGfnPy+f?= =?us-ascii?q?jH/uTx2pLuhIiGeQOxkNlpu6d0NWFWX7TN/gIia+OdtzgCx+laY4nVvWJGUcNn?= =?us-ascii?q?56aEoLobqOu3ALys5jEnBMuyI2ZdKPnDyUuqyBcM4b?= X-IPAS-Result: =?us-ascii?q?A2CQAABO5e1Z/wHyM5BcDgsBAQEBAQEBAQEBAQcBAQEBARU?= =?us-ascii?q?BAQEBAgEBAQEIAQEBAYMILIFSJ4N6ih+PQj8BAQEBAQEGgS+WORCCAYVFAoRRP?= =?us-ascii?q?xgBAQEBAQEBAQEBAWoogjgkAYJAAQEBAQIBHQYPAVYJAhgCAhEVAgJXBgESiAa?= =?us-ascii?q?CDQUIjkWdZ4InhBQBAYcJAQEIAQEBASSBD4IfggeBCYVahECBBIJVgmEBBKFml?= =?us-ascii?q?HSCFYV6ixJIiV2NEB84gVsqCgIfCCMPgy2EIAQBViQ2i3oBAQE?= Message-ID: <1508763459.24902.1.camel@tycho.nsa.gov> Subject: Re: [RFC PATCH 1/2] security, capabilities: Add CAP_SYS_MOUNT From: Stephen Smalley To: Nicolas Belouin , David Howells , "Theodore Ts'o" , Andreas Dilger , Alexander Viro , Serge Hallyn , Paul Moore , Eric Paris , James Morris , linux-cachefs@redhat.com, linux-kernel@vger.kernel.org, linux-ext4@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, linux-api@vger.kernel.org, kernel-hardening@lists.openwall.com Date: Mon, 23 Oct 2017 08:57:39 -0400 In-Reply-To: <20171021134303.20685-1-nicolas@belouin.fr> References: <20171021134303.20685-1-nicolas@belouin.fr> Organization: National Security Agency Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.22.6 (3.22.6-2.fc25) Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, 2017-10-21 at 15:43 +0200, Nicolas Belouin wrote: > With CAP_SYS_ADMIN being bloated and inapropriate for actions such > as mounting/unmounting filesystems, the creation of a new capability > is needed. > CAP_SYS_MOUNT is meant to give a process the ability to call for > mount, > umount and umount2 syscalls. If adding a new capability isn't deemed acceptable, then another option would be to introduce LSM hooks where there isn't already coverage and implement finer-grained permission checks there. In some cases, that already occurs for mount and umount*. That also offers the possibility of taking the object of the operation into account, unlike capabilities which are only subject/process-based. > > Signed-off-by: Nicolas Belouin > --- >  include/uapi/linux/capability.h     | 5 ++++- >  security/selinux/include/classmap.h | 4 ++-- >  2 files changed, 6 insertions(+), 3 deletions(-) > > diff --git a/include/uapi/linux/capability.h > b/include/uapi/linux/capability.h > index 230e05d35191..ce230aa6d928 100644 > --- a/include/uapi/linux/capability.h > +++ b/include/uapi/linux/capability.h > @@ -365,8 +365,11 @@ struct vfs_ns_cap_data { >   >  #define CAP_AUDIT_READ 37 >   > +/* Allow mounting, unmounting filesystems */ >   > -#define CAP_LAST_CAP         CAP_AUDIT_READ > +#define CAP_SYS_MOUNT 38 > + > +#define CAP_LAST_CAP         CAP_SYS_MOUNT >   >  #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) >   > diff --git a/security/selinux/include/classmap.h > b/security/selinux/include/classmap.h > index 35ffb29a69cb..a873dce97fd5 100644 > --- a/security/selinux/include/classmap.h > +++ b/security/selinux/include/classmap.h > @@ -24,9 +24,9 @@ >       "audit_control", "setfcap" >   >  #define COMMON_CAP2_PERMS  "mac_override", "mac_admin", "syslog", \ > - "wake_alarm", "block_suspend", "audit_read" > + "wake_alarm", "block_suspend", "audit_read", > "sys_mount" >   > -#if CAP_LAST_CAP > CAP_AUDIT_READ > +#if CAP_LAST_CAP > CAP_SYS_MOUNT >  #error New capability defined, please update COMMON_CAP2_PERMS. >  #endif >