Re: [PATCH -v3 1/3] Capabilities: move cap_file_mmap to commoncap.c

On Thu, 2009-07-30 at 14:31 -0400, Eric Paris wrote:
On Thu, 2009-07-30 at 13:50 -0400, Eric Paris wrote:
On Thu, 2009-07-30 at 11:58 -0400, Stephen Smalley wrote:
On Thu, 2009-07-30 at 10:54 -0500, Serge E. Hallyn wrote:
Quoting Eric Paris (eparis@xxxxxxxxxx):
On Thu, 2009-07-30 at 00:14 -0500, Serge E. Hallyn wrote:
Quoting Eric Paris (eparis@xxxxxxxxxx):
Currently we duplicate the mmap_min_addr test in cap_file_mmap and in
security_file_mmap if !CONFIG_SECURITY. This patch moves cap_file_mmap
into commoncap.c and then calls that function directly from
security_file_mmap ifndef CONFIG_SECURITY like all of the other capability
checks are done.

It also

1. changes the return value in error case from -EACCES to
-EPERM
2. no onger sets PF_SUPERPRIV in t->flags if the capability
is used.

Do we care about these?

Personally, not really, but I'll gladly put them back if you care. #2
seems more interesting to me than number 1. I actually kinda like
getting EPERM from caps rather than EACCES since them I know if I was
denied by selinux or by caps.....

-Eric

Yup, I asked bc I didn't particularly care myself.

I think I agree with you about -EPERM being better anyway. However I
(now) think in this case PF_SUPERPRIV definately should be set, as this
is a clear use of a capability to do something that couldn't have been
done without it.

On a related but different note, we should consider all current uses of
cap_capable(), as they represent capability checks that will not be
subject to a further restrictive check by other security modules. In
this case and in the vm_enough_memory case, that is intentional, but not
so clear for other uses in commoncap.c.

Most of commoncap.c is called either as a secondary hook from the active
lsm (aka selinux calls the commoncap.c functions) or in the !
CONFIG_SECURITY case.

I'll audit this afternoon to see which of them might not fit these
rules....

I just went through all of the cap_* function in commoncap.c to see
which of them are being or are not being called from the selinux hooks.
Only 3 of them look interesting.

cap_inode_setxattr
cap_inode_removexattr
cap_vm_enough_memory

All of the other functions are either called from hooks.c or SELinux
does not define that LSM hook, so it just defaults to the cap_* hook.

These 3 are all a bit odd because the logic inside the cap_ hook is
duplicated inside the selinux_ hook. I'd much rather see the selinux_
hook call the cap_ hook. I'm going to think on that topic, but it's a
different set of patches and I don't see missing checks today as the
logic seems to line up.

Yes, those 3 aren't a problem. I suppose selinux_inode_setotherxattr()
could be changed to call cap_inode_setxattr() before the SELinux setattr
check, as that would only happen in the non-selinux attribute case.

--
Stephen Smalley
National Security Agency

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages

  • Re: [PATCH -v3 1/3] Capabilities: move cap_file_mmap to commoncap.c
    ... security_file_mmap ifndef CONFIG_SECURITY like all of the other capability ... denied by selinux or by caps..... ... Most of commoncap.c is called either as a secondary hook from the active ... does not define that LSM hook, so it just defaults to the cap_* hook. ...
    (Linux-Kernel)
  • Re: + smack-version-11c-simplified-mandatory-access-control-kernel.patch
    ... Quoting Stephen Smalley: ... + * There are not enough CAP bits available to make this ... so Casey borrowed the capability that looks to ... Smack - other MAC modules like SELinux won't honor it. ...
    (Linux-Kernel)
  • Re: [PATCH 3/7] SLIM main patch
    ... on that and have implemented the file_receive hook, however, once we ... LSM_UNSAFE_SHARE check applied by SELinux (since we are only flushing ... Device nodes can certainly support xattrs, ... measurement makes your measurements rather meaningless. ...
    (Linux-Kernel)
  • Re: [PATCH -v3 1/3] Capabilities: move cap_file_mmap to commoncap.c
    ... security_file_mmap ifndef CONFIG_SECURITY like all of the other capability ... denied by selinux or by caps..... ... subject to a further restrictive check by other security modules. ... I don't see any reason why that shouldn't be capable. ...
    (Linux-Kernel)
  • Re: [PATCH 2/5] Rework stubs in security.h
    ... static inline int security_ptrace (struct task_struct * parent, ... That makes capability part of the core kernel again, just like DAC, ... > I havn't looked at every single hook and it's users to see if this would ...
    (Linux-Kernel)