security capabilities on filesystems

security capabilities on filesystems

[Lukasz Stelmach]

[-- Attachment #1: Type: text/plain, Size: 430 bytes --]

Greetings.

I've poke around for some information but all I got (was this lousy t-shirt)
that there is no support for capablities stored on a filesystem. However, I'd
like to ask if there are any chances to see this feature soon.

Best regards.

PS. Please CC.
-- 
Było mi bardzo miło.                    Czwarta pospolita klęska, [...]
>Łukasz<                      Już nie katolicka lecz złodziejska.  (c)PP


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 256 bytes --]

Re: security capabilities on filesystems

[Peter Gordon]

On 1/29/06, Lukasz Stelmach <stlman@poczta.fm> wrote:
> Greetings.
>
> I've poke around for some information but all I got (was this lousy t-shirt)
> that there is no support for capablities stored on a filesystem. However, I'd
> like to ask if there are any chances to see this feature soon.
>

What do you mean exactly? Ext2 (and its journalled cousin, Ext3; I'm
not certain of other filesystems) can both store POSIX-style Access
Control Lists (ACLs) and SELinux labeling as part of the inode
metadata. Hope this helps.

Re: security capabilities on filesystems

[Lukasz Stelmach]

[-- Attachment #1: Type: text/plain, Size: 1063 bytes --]

Peter Gordon wrote:

>>I've poke around for some information but all I got (was this lousy t-shirt)
>>that there is no support for capablities stored on a filesystem. However, I'd
>>like to ask if there are any chances to see this feature soon.
> 
> What do you mean exactly? Ext2 (and its journalled cousin, Ext3; I'm
> not certain of other filesystems) can both store POSIX-style Access
> Control Lists (ACLs) and SELinux labeling as part of the inode
> metadata.

Reiserfs, xfs and jfs too.

Yet they all can't store, or I don't know how to set it up, POSIX
capabilities for executables. Those like CAP_NET_RAW or CAP_SYS_RAWIO.
The former is useful for ping the latter (was?) for X11. I know that this
functionality can be achived with SELinux but it's to havy-weight for me.
I'd rather implement BSD seclevels and capabilities.

> Hope this helps.

I am afraid no :-(

Bye.
-- 
Było mi bardzo miło.                    Czwarta pospolita klęska, [...]
>Łukasz<                      Już nie katolicka lecz złodziejska.  (c)PP


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 256 bytes --]

Re: security capabilities on filesystems

[Arjan van de Ven]

On Sun, 2006-01-29 at 21:04 +0100, Lukasz Stelmach wrote:
> Greetings.
> 
> I've poke around for some information but all I got (was this lousy t-shirt)
> that there is no support for capablities stored on a filesystem. However, I'd
> like to ask if there are any chances to see this feature soon.

this has been asked many many times, and the answer seems to always have
been "no because that's not secure"; I suggest google as a way to find
out more details...

Re: security capabilities on filesystems

[Stephen Smalley]

On Sun, 2006-01-29 at 21:04 +0100, Lukasz Stelmach wrote:
> Greetings.
> 
> I've poke around for some information but all I got (was this lousy t-shirt)
> that there is no support for capablities stored on a filesystem. However, I'd
> like to ask if there are any chances to see this feature soon.

Storage of the capability bits isn't the hard part; that is especially
easy these days given the extensible security namespace for extended
attributes that was introduced for SELinux (but not limited to it).

# touch foo
# setfattr -n security.capability.effcap -v 0xdeadbeef foo
# getfattr -e hex -n security.capability.effcap foo
# file: foo
security.capability.effcap=0xdeadbeef

-- 
Stephen Smalley
National Security Agency