• Andrew G. Morgan's avatar
    capabilities: implement per-process securebits · 3898b1b4
    Andrew G. Morgan authored
    Filesystem capability support makes it possible to do away with (set)uid-0
    based privilege and use capabilities instead.  That is, with filesystem
    support for capabilities but without this present patch, it is (conceptually)
    possible to manage a system with capabilities alone and never need to obtain
    privilege via (set)uid-0.
    
    Of course, conceptually isn't quite the same as currently possible since few
    user applications, certainly not enough to run a viable system, are currently
    prepared to leverage capabilities to exercise privilege.  Further, many
    applications exist that may never get upgraded in this way, and the kernel
    will continue to want to support their setuid-0 base privilege needs.
    
    Where pure-capability applications evolve and replace setuid-0 binaries, it is
    desirable that there be a mechanisms by which they can contain their
    privilege.  In addition to leveraging the per-process bounding and inheritable
    sets, this should include suppressing the privilege of the uid-0 superuser
    from the process' tree of children.
    
    The feature added by this patch can be leveraged to suppress the privilege
    associated with (set)uid-0.  This suppression requires CAP_SETPCAP to
    initiate, and only immediately affects the 'current' process (it is inherited
    through fork()/exec()).  This reimplementation differs significantly from the
    historical support for securebits which was system-wide, unwieldy and which
    has ultimately withered to a dead relic in the source of the modern kernel.
    
    With this patch applied a process, that is capable(CAP_SETPCAP), can now drop
    all legacy privilege (through uid=0) for itself and all subsequently
    fork()'d/exec()'d children with:
    
      prctl(PR_SET_SECUREBITS, 0x2f);
    
    This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES is
    enabled at configure time.
    
    [akpm@linux-foundation.org: fix uninitialised var warning]
    [serue@us.ibm.com: capabilities: use cap_task_prctl when !CONFIG_SECURITY]
    Signed-off-by: default avatarAndrew G. Morgan <morgan@kernel.org>
    Acked-by: default avatarSerge Hallyn <serue@us.ibm.com>
    Reviewed-by: default avatarJames Morris <jmorris@namei.org>
    Cc: Stephen Smalley <sds@tycho.nsa.gov>
    Cc: Paul Moore <paul.moore@hp.com>
    Signed-off-by: default avatarSerge E. Hallyn <serue@us.ibm.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    3898b1b4
sys.c 42.3 KB