Re: [PATCH 3/4] security: capabilities patch (version 0.4.4), part 3/4: introduce new capabilities

[Casey Schaufler <casey@schaufler-ca.com>]

--- Joshua Brindle <method@gentoo.org> wrote:

> Casey Schaufler wrote:
> > --- Joshua Brindle <method@gentoo.org> wrote:
> >   
> >>> The first system I took through evaluation
> >>> (that is, independent 3rd party analysis) stored
> >>> security attributes in a file while the second
> >>> and third systems attached the attributes
> >>> directly (XFS). The 1st evaluation required
> >>> 5 years, the 2nd 1 year. It is possible that
> >>> I just got a lot smarter with age, but I
> >>> ascribe a significant amount of the improvement
> >>> to the direct association of the attributes
> >>> to the file.
> >>>       
> >> Thats great but entirely irrelevant in this
> context.
> >> The patch and caps 
> >> in question are not attached to the file via some
> >> externally observable 
> >> property (eg., xattr) but instead are embedded in
> >> the source code so 
> >> that it can drop caps at certain points during
> the
> >> execution or before 
> >> executing another app, thus unanalyzable.
> >>     
> >
> > Oh that. Sure, we used capability bracketing
> > in the code, too. That makes it easy to
> > determine when a capability is active. What,
> > you don't think that it's possible to analyze
> > source code? Of course it is. Refer to the
> > evaluation reports if you don't believe me.
> >
> >   
> When I see an analysis of every line of source code
> on an average Linux 
> machine then I might believe you

Would an above average Unix system suffice?
How about MULTICS?

It's been done for:
    Irix and Trusted Irix
    Solaris and Trusted Solaris
    UNICOS
    HP/UX
    AIX
    SystemV
    Xenix

> (if you'll grant
> that no software can 
> ever be installed on it afterward without being
> analyzed)

Rubbish. No privileged software can be installed.
Software that runs as a user without capabilities
can be installed freely. It only requires analysis
if it violates policy, which on a system with
POSIX capabilities means running in possession
of capabilities. 

> but until then 
> I'll stick with a centralized policy.

OK. There is value in containment.

> I doubt many others will be 
> satisfied with that limitation.

It's been selling in the marketplace for
the past 20 years.

> Bracketing hardly makes it analyzable, how can you
> possibly know if the 
> bracketing happened?

Err, read the code?

> You *believe* it will and
> therefore you say that 
> the bracketed code is safe but in reality this is a
> discretionary 
> mechanism and you have zero assurance that there is
> any security whatsoever,

Ah, no. You don't seem to understand the concept.

> no thanks, I'll pass.

Probably just as well, all things considered.


Casey Schaufler
casey@schaufler-ca.com