Re: [PATCH 0/2] file capabilities: two bugfixes

["Serge E. Hallyn" <serue@us.ibm.com>]

Quoting Casey Schaufler (casey@schaufler-ca.com):
> 
> --- "Serge E. Hallyn" <serue@us.ibm.com> wrote:
> 
> > ...
> > The other is that root can lose capabilities by
> > executing files with
> > only some capabilities set.  The next two patches
> > change these
> > behaviors.
> 
> It was the intention of the POSIX group that
> capabilities be independent of uid. I would
> argue that the old bevavior was correct, that
> a program marked to lose a capability ought
> to even if the uid is 0.

Agreed, and if SECURE_NOROOT is set, that is what happens.
But by default SECURE_NOROOT is not set, in which case linux's
implementation of capabilities behaves differently for root.

Without this latest patch, with SECURE_NOROOT not set, what was
actually happening was that the kernel behaved as though
SECURE_NOROOT was not set so long as there was no
security.capability xattr, and always behaved as though
SECURE_NOROOT was set if there was an xattr.  That's inconsistent
and confusing behavior.

The worst part is that root can get around running the code
with limited caps by just copying the file and running the
copy.  So it adds no security benefit, and adds an
inconsistency/complication which could cause security risks.

-serge