Request change in behaviour of capability inheritance.

Request change in behaviour of capability inheritance.

[rgarcia]

I think that the current behaviour of capability inheritance across exec()
is not optimal.

The current behaviour consists in all effective and permitted capabilities
are cleared across a exec(). This is because it seems to be intended that
in the future the executable files have a set of "allowed" and "forced"
capabilities.  If a capability is not allowed, it is not permitted in an
inherited process. But at pressent, there is no attribute of "allowed"
capabilities in the filesystem, and the behaviour is that no capability is
allowed.

I request to change this behaviour. By default all capabilities should be
allowed, that is, inherited across exec().

This is neccessary to protect a daemon without changing its source. With
the requested behaviour, it would be posible to launch a daemon intented
to run as root, as an unpriviledged user but with the neccessary
capabilities, by using a script or program that changes the uid and the
capabilities and then launches the daemon.

Thus the present behaviour of no "allowed" capabilities pretends to be
more secure, but is actually less secure. By default, all parent
priviledges should be inherited, because this allows one to create
programs and scripts that execute daemons or other programs in a
restricted environment.

I am modifying kernel source for our own setup. I think others should


----------------------------------------------
Ramon Garcia Fernandez
Kotasoft, your experts in Linux consulting
----------------------------------------------

Re: Request change in behaviour of capability inheritance.

[Casey Schaufler]

--- rgarcia@kotasoft.com wrote:

> I think that the current behaviour of capability
> inheritance across exec()
> is not optimal.
> 
> The current behaviour consists in all effective and
> permitted capabilities
> are cleared across a exec(). This is because it
> seems to be intended that
> in the future the executable files have a set of
> "allowed" and "forced"
> capabilities.

File based capabilities are the same
effective, permitted, and inheritable
sets that the process has. Unless the
thinking has shifted over the last couple
weeks (it happens from time to time)
the inheritable set is what you're
missing.



Casey Schaufler
casey@schaufler-ca.com

Re: Request change in behaviour of capability inheritance.

[rgarcia]

I was reading the capabilities(7) man page. I agree with you about the
language. What I am requesting is that for any file without extra
attributes, the inheritable and effective set should be full.

Ramon