Hello, This is probably not possible to fix -- it was a widely accepted criticism of the POSIX draft capabilities, and Linux implemented capabilities, that it is an impossible task to prevent individual capability grants from 'bleeding' over into privileges that correspond to other capabilities.
If you get any traction reporting this issue to upstreams please do report back, but please don't take it too hard if they're not interested in trying to build stronger separation between root's various capabilities. Thanks ** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-signed in Ubuntu. https://bugs.launchpad.net/bugs/1785687 Title: btrfs send can bypass DAC check with certain capability set Status in linux-signed package in Ubuntu: New Bug description: Expected: For btrfs tool with certain capabilities set(cap_fowner, cap_sys_admin), DAC check should not be by-passed when operating on subvol snapshot What happened instead: btrfs tool with certain capability(cap_fowner,cap_sys_admin) set can be used to by-pass DAC check on a snapshot, and gain read access to all files in a snapshot steps to reproduce: as root # dd if=/dev/zero of=/tmp/test.disk bs=1M count=128 # mkfs.btrfs /tmp/test.disk # mkdir -p /mnt/test # mount /tmp/test.disk /mnt/test/ # cd /mnt/test # btrfs subvol create snapshot # echo "this is a secret" > snapshot/1.secret # chmod 600 snapshot/1.secret # btrfs subvol snapshot -r snapshot snapshot-ro # setcap cap_fowner,cap_sys_admin+eip /bin/btrfs as non-root $ cd /mnt/test $ cat snapshot-ro/1.secret cat: snapshot-ro/1.secret: Permission denied $ btrfs send snapshot-ro > /tmp/snap $ strings /tmp/snap this is a secret ProblemType: Bug DistroRelease: Ubuntu 18.04 Package: linux-image-4.15.0-23-generic 4.15.0-23.25 ProcVersionSignature: Ubuntu 4.15.0-23.25-generic 4.15.18 Uname: Linux 4.15.0-23-generic x86_64 ApportVersion: 2.20.9-0ubuntu7 Architecture: amd64 CurrentDesktop: ubuntu:GNOME Date: Mon Aug 6 11:18:18 2018 InstallationDate: Installed on 2018-05-17 (80 days ago) InstallationMedia: Ubuntu 14.04.5 LTS "Trusty Tahr" - Release amd64 (20160803) SourcePackage: linux-signed UpgradeStatus: No upgrade log present (probably fresh install) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux-signed/+bug/1785687/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
