From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932212AbdJURbb (ORCPT ); Sat, 21 Oct 2017 13:31:31 -0400 Received: from nm13-vm4.bullet.mail.ne1.yahoo.com ([98.138.91.173]:35055 "EHLO nm13-vm4.bullet.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932188AbdJURb3 (ORCPT ); Sat, 21 Oct 2017 13:31:29 -0400 X-Yahoo-Newman-Id: 541052.53977.bm@smtp210.mail.ne1.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: 1yXE1_UVM1mETI9zKSCRRVZqYc7djpVMniCkiqaapcs0GhP _31Xyyxnx441FtwWWRMjEKPbZCrMBKhGbUJS9XSKJbqKVy0aK36OFBGRksso 0Y7B0sDph4qDgAyb0UVRG8p8KAp8QaFhdGEdQFajrnUsWJorYFQ2.rYTyF6V fZBSe4m5y8H1pakK1avg0sCoxTd2kg_mSupX4PG0QPLMZVepOq4hnp9GyuAU zTemENKCSsgnpyMmPKwDUX7H_rehxaAJFwvMZ8xVs1CqamLZWO0guXwm4deV 9Dt6OG46MCvumrqO4j56u15FIajckpd4bnMX3OaEp7dcuJrcb0eaJO4pdiGP lDpIUeJrKNF1BhXGYfIhm1gQzDRvwT_0Qt.k1n8rywljB8g1bA5rLbudqt_b cYizSvFcD5irt2am5uB29nQ7skSoiMAlUwWEDO_MBg1eXa.ZvZnlTODoOfpa Gk.sg7_aHv7p7QaOkM8XjIJpAYoyvUD6aPv3pM0BfAAcjVgYnNVIV0FsNHkN RBGHfh5hX0HvrMJ0u53mYWA-- X-Yahoo-SMTP: OIJXglSswBDfgLtXluJ6wiAYv6_cnw-- Subject: Re: [kernel-hardening] [RFC PATCH 1/2] security, capabilities: Add CAP_SYS_MOUNT To: Nicolas Belouin , David Howells , "Theodore Ts'o" , Andreas Dilger , Alexander Viro , Serge Hallyn , Paul Moore , Stephen Smalley , Eric Paris , James Morris , linux-cachefs@redhat.com, linux-kernel@vger.kernel.org, linux-ext4@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, linux-api@vger.kernel.org, kernel-hardening@lists.openwall.com References: <20171021134303.20685-1-nicolas@belouin.fr> From: Casey Schaufler Message-ID: Date: Sat, 21 Oct 2017 10:31:24 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <20171021134303.20685-1-nicolas@belouin.fr> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Content-Language: en-US Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/21/2017 6:43 AM, Nicolas Belouin wrote: > With CAP_SYS_ADMIN being bloated and inapropriate for actions such > as mounting/unmounting filesystems, the creation of a new capability > is needed. > CAP_SYS_MOUNT is meant to give a process the ability to call for mount, > umount and umount2 syscalls. This is increased granularity for it's own sake. There is no compelling reason to break out this capability in particular. Can you identify existing use cases where you would have CAP_SYS_MOUNT without also having CAP_SYS_ADMIN? I should think that all the work that's gone into unprivileged mounts over the past couple years would make this unnecessary. > Signed-off-by: Nicolas Belouin > --- > include/uapi/linux/capability.h | 5 ++++- > security/selinux/include/classmap.h | 4 ++-- > 2 files changed, 6 insertions(+), 3 deletions(-) > > diff --git a/include/uapi/linux/capability.h b/include/uapi/linux/capability.h > index 230e05d35191..ce230aa6d928 100644 > --- a/include/uapi/linux/capability.h > +++ b/include/uapi/linux/capability.h > @@ -365,8 +365,11 @@ struct vfs_ns_cap_data { > > #define CAP_AUDIT_READ 37 > > +/* Allow mounting, unmounting filesystems */ > > -#define CAP_LAST_CAP CAP_AUDIT_READ > +#define CAP_SYS_MOUNT 38 > + > +#define CAP_LAST_CAP CAP_SYS_MOUNT > > #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) > > diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h > index 35ffb29a69cb..a873dce97fd5 100644 > --- a/security/selinux/include/classmap.h > +++ b/security/selinux/include/classmap.h > @@ -24,9 +24,9 @@ > "audit_control", "setfcap" > > #define COMMON_CAP2_PERMS "mac_override", "mac_admin", "syslog", \ > - "wake_alarm", "block_suspend", "audit_read" > + "wake_alarm", "block_suspend", "audit_read", "sys_mount" > > -#if CAP_LAST_CAP > CAP_AUDIT_READ > +#if CAP_LAST_CAP > CAP_SYS_MOUNT > #error New capability defined, please update COMMON_CAP2_PERMS. > #endif >