Re: request: capabilities that allow users to drop privileges further

[Chris Wright <chrisw@osdl.org>]

* Felix von Leitner (felix-kernel@fefe.de) wrote:
> I would like to be able to drop capabilities that every normal user has,
> so that network servers can limit the impact of possible future security
> problems further.  For example, I want my non-cgi web server to be able
> to drop the capabilities to

Using existing capabilities system you can limit many of these.  Just
dropping privs from uid = 0 to anything else is a good start.

>   * fork

rlimit

>   * execve

mount fs noexec

>   * ptrace

drop CAP_SYS_PTRACE

>   * load kernel modules

drop CAP_SYS_MODULE

>   * mknod

drop CAP_MKNOD

>   * write to the file system

mount fs r/o.

In general, most of what you ask for is already there.  Otherwise use
some MAC policy that gives you the control you want (check out SELinux
for example).

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net