Re: [PATCH] per-process securebits

[Andrew Morton]

On Mon, 4 Feb 2008 18:17:22 +
Pavel Machek [EMAIL PROTECTED] wrote:

 On Fri 2008-02-01 20:07:01, James Morris wrote:
  On Fri, 1 Feb 2008, Andrew Morton wrote:
  
   Really?  I'd feel a lot more comfortable if yesterday's version 1 had led
   to a stream of comments from suitably-knowledgeable kernel developers 
   which
   indicated that those developers had scrutinised this code from every
   conceivable angle and had declared themselves 100% happy with it.
  
  FWIW, I've reviewed the patch in detail a couple of times, and don't see 
  any issues with it that haven't already been raised by Serge.
  
  You can add my reviewed-by.
  
  I think it does need more eyes, and some time baking in -mm.  
 
 I don't thing -mm baking helps here. People playing with -mm are not
 the ones trying to hack your box.
 

That's for sure.  Whitebox testing and really really careful review
is our best shot with this stuff.
-
To unsubscribe from this list: send the line unsubscribe 
linux-security-module in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] per-process securebits

[Ismail Dönmez]

At Monday 04 February 2008 around 18:45:24 Serge E. Hallyn wrote:
 Quoting Andrew G. Morgan ([EMAIL PROTECTED]):
  -BEGIN PGP SIGNED MESSAGE-
  Hash: SHA1
 
  Ismail D??nmez wrote:
  | What I meant to ask was what does per-process securebits brings as
 
  extra.
 
  It allows you to create a legacy free process tree. For example, a
  chroot, or container (which Serge can obviously explain in more detail),

 (Just to give my thoughts on securebits and containers)

 A container is a set of processes which has its own private namespaces
 for all or most resources - for instance it sees only processes in its
 own pid namespace, and its first process, which is sees as pid 1, is
 known as some other pid, maybe 3459, to the rest of the system.

 We tend to talk about 'system containers' versus 'application
 containers'.  A system container would be like a vserver or openvz
 instance, something which looks like a separate machine.  I was
 going to say I don't imagine per-process securebits being useful
 there, but actually since a system container doesn't need to do any
 hardware setup it actually might be a much easier start for a full
 SECURE_NOROOT distro than a real machine.  Heck, on a real machine init
 and a few legacy deamons could run in the init namespace, while users
 log in and apache etc run in a SECURE_NOROOT container.

 But I especially like the thought of for instance postfix running in a
 carefully crafted application container (with its own virtual network
 card and limited file tree and no visibility of other processes) with
 SECURE_NOROOT on.

This is really interesting security wise, will be nice to see how it can be 
implemented in real life.

Thanks for the explanation and the implementation ;-)

Regards,
ismail

-- 
Never learn by your mistakes, if you do you may never dare to try again.
-
To unsubscribe from this list: send the line unsubscribe 
linux-security-module in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] per-process securebits

[Andrew G. Morgan]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Ismail Dönmez wrote:
| What I meant to ask was what does per-process securebits brings as
extra.

It allows you to create a legacy free process tree. For example, a
chroot, or container (which Serge can obviously explain in more detail),
environment in which root has no privilege at all. One in which
privilege comes only from filesystem capabilities.

| FWIW in Pardus 2008 we'll enable Posix file capabilities by default so
people
| could harden their setups.

Cheers

Andrew
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQFHpmYd+bHCR3gb8jsRAlDHAJ9RvFRieU2eUPJUHh7K84NMLmytTQCgupfS
KxdoXz400AeMWJiaikGH9U8=
=yx8I
-END PGP SIGNATURE-
-
To unsubscribe from this list: send the line unsubscribe 
linux-security-module in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] per-process securebits

[Andrew G. Morgan]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Andrew Morton wrote:
| On Fri, 01 Feb 2008 00:11:37 -0800 Andrew G. Morgan
[EMAIL PROTECTED] wrote:
|
| [This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES
|  is enabled at configure time.]
|
| Patches like this scare the pants off me.

Nice to know I'm not being mediocre! :-D

| I'd have to recommend that distributors not enable this feature (if we
| merge it) until they have 100% convinced themselves that it is 100%
| correct.

FWIW I'm in complete agreement if you are referring to
CONFIG_SECURITY_FILE_CAPABILITIES and not just this patch...

As to the rest, the short version:

* The sendmail thing was a subtle problem trying to map setuid(non-0)
into a capability framework. The long and the short of it was that an
unprivileged user could prevent a privileged application from exercising
all of the privilege it needed and getting root access as a result.

* I'm saying setuid(0) apps will most definitely continue to be
supported by a kernel even with CONFIG_SECURITY_FILE_CAPABILITIES=y. All
the patch does is make it possible for a capable(CAP_SETPCAP) process to
declare itself as the parent of a process tree in which that is not the
case.

Here is the very very long version (which took some time to write, and I
thought was a bit much to spam these lists with):

http://userweb.kernel.org/~morgan/sendmail-capabilities-war-story.html

Cheers

Andrew

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQFHpVjP+bHCR3gb8jsRAsMtAJ9XqR0yaeY8O3F8/nCdoALPksKZOQCg06/7
pJOZRfMORnI8YfIcta5nVLw=
=Rpj4
-END PGP SIGNATURE-
-
To unsubscribe from this list: send the line unsubscribe 
linux-security-module in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] per-process securebits

[Andrew G. Morgan]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1



[EMAIL PROTECTED] wrote:
| Quoting Andrew G. Morgan ([EMAIL PROTECTED]):
| -BEGIN PGP SIGNED MESSAGE-
| Hash: SHA1
|
| Here is the patch to add per-process securebits.
|
| Its all code that lives inside the capability LSM and the new securebits
| implementation is only active if CONFIG_SECURITY_FILE_CAPABILITIES is
| enabled (it doesn't make much sense to support this feature without
| filesystem capabilities).
|
| The patch assumes the CAP_SETPCAP fix of last week, but is otherwise on
| top of 2.6.24-rc8-mm1.
|
| Hey Andrew,  I'm about to set up some ltp tests, but noticed the
| following patch is needed on top of yours.

Sorry about that. I'm guessing you have a more pedantic compiler than
mine (x86_64)!

Acked-by: Andrew G. Morgan [EMAIL PROTECTED]

Cheers

Andrew

|
| -serge
|
|From feac61b47be8375e25b0f6ee876cf096c8b1b9cc Mon Sep 17 00:00:00 2001
| From: Serge E. Hallyn [EMAIL PROTECTED]
| Date: Fri, 1 Feb 2008 14:13:29 +
| Subject: [PATCH 1/1] per-process securebits: security_task_prctl takes
a long
|
| Fix a mismatch between prototypes and callers for the updated
| security_task_prctl().  The newly introduced argument, error,
| is a long, not an int.
|
| Signed-off-by: Serge E. Hallyn [EMAIL PROTECTED]
| ---
|  include/linux/security.h |8 
|  security/commoncap.c |4 ++--
|  security/dummy.c |2 +-
|  security/security.c  |2 +-
|  security/selinux/hooks.c |2 +-
|  5 files changed, 9 insertions(+), 9 deletions(-)
|
| diff --git a/include/linux/security.h b/include/linux/security.h
| index c550079..c789a0d 100644
| --- a/include/linux/security.h
| +++ b/include/linux/security.h
| @@ -63,7 +63,7 @@ extern int cap_task_post_setuid (uid_t old_ruid,
uid_t old_euid, uid_t old_suid,
|  extern void cap_task_reparent_to_init (struct task_struct *p);
|  extern int cap_task_kill(struct task_struct *p, struct siginfo *info,
int sig, u32 secid);
|  extern int cap_task_prctl(int option, unsigned long arg2, unsigned
long arg3,
| -   unsigned long arg4, unsigned long arg5, int *rc_p);
| +   unsigned long arg4, unsigned long arg5, long *rc_p);
|  extern int cap_task_setscheduler (struct task_struct *p, int policy,
struct sched_param *lp);
|  extern int cap_task_setioprio (struct task_struct *p, int ioprio);
|  extern int cap_task_setnice (struct task_struct *p, int nice);
| @@ -1348,7 +1348,7 @@ struct security_operations {
|   int (*task_wait) (struct task_struct * p);
|   int (*task_prctl) (int option, unsigned long arg2,
|  unsigned long arg3, unsigned long arg4,
| -unsigned long arg5, int *rc_p);
| +unsigned long arg5, long *rc_p);
|   void (*task_reparent_to_init) (struct task_struct * p);
|   void (*task_to_inode)(struct task_struct *p, struct inode *inode);
|
| @@ -1602,7 +1602,7 @@ int security_task_kill(struct task_struct *p,
struct siginfo *info,
|   int sig, u32 secid);
|  int security_task_wait(struct task_struct *p);
|  int security_task_prctl(int option, unsigned long arg2, unsigned long
arg3,
| -  unsigned long arg4, unsigned long arg5, int *rc_p);
| +  unsigned long arg4, unsigned long arg5, long *rc_p);
|  void security_task_reparent_to_init(struct task_struct *p);
|  void security_task_to_inode(struct task_struct *p, struct inode *inode);
|  int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
| @@ -2151,7 +2151,7 @@ static inline int security_task_wait (struct
task_struct *p)
|  static inline int security_task_prctl (int option, unsigned long arg2,
|  unsigned long arg3,
|  unsigned long arg4,
| -unsigned long arg5, int *rc_p)
| +unsigned long arg5, long *rc_p)
|  {
|   return 0;
|  }
| diff --git a/security/commoncap.c b/security/commoncap.c
| index 9b87182..858387a 100644
| --- a/security/commoncap.c
| +++ b/security/commoncap.c
| @@ -611,9 +611,9 @@ int cap_task_kill(struct task_struct *p, struct
siginfo *info,
|  #endif
|
|  int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
| -unsigned long arg4, unsigned long arg5, int *rc_p)
| +unsigned long arg4, unsigned long arg5, long *rc_p)
|  {
| - int error = 0;
| + long error = 0;
|
|   switch (option) {
|   case PR_CAPBSET_READ:
| diff --git a/security/dummy.c b/security/dummy.c
| index c9e6d9f..e79f988 100644
| --- a/security/dummy.c
| +++ b/security/dummy.c
| @@ -595,7 +595,7 @@ static int dummy_task_kill (struct task_struct *p,
struct siginfo *info,
|  }
|
|  static int dummy_task_prctl (int option, unsigned long arg2, unsigned
long arg3,
| -  unsigned long arg4, unsigned long arg5, int *rc_p)
| +

Re: [PATCH] per-process securebits

[Ismail Dönmez]

At Sunday 03 February 2008 around 08:18:12 Andrew Morton wrote:
 So how do we ever get to the stage where we can recommend that distributors
 turn these things on, and have them agree with us?

FWIW with my distributor hat on I think File system capabilities are very nice 
and enables one to ship a distribution with a small set of setuid binaries.

On the other hand for per-process securebits, it would be nice to see a 
complete example how it could be applied to a setuid program. That would be a 
nice step in moving forward.

Regards,
ismail

-- 
Never learn by your mistakes, if you do you may never dare to try again.
-
To unsubscribe from this list: send the line unsubscribe 
linux-security-module in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] per-process securebits

[Andrew G. Morgan]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Here is the patch to add per-process securebits.

Its all code that lives inside the capability LSM and the new securebits
implementation is only active if CONFIG_SECURITY_FILE_CAPABILITIES is
enabled (it doesn't make much sense to support this feature without
filesystem capabilities).

The patch assumes the CAP_SETPCAP fix of last week, but is otherwise on
top of 2.6.24-rc8-mm1.

Cheers

Andrew
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQFHotQ5+bHCR3gb8jsRAhP5AKDOxsINGzO0aZcYmAH1aqrNOHn03ACghrbJ
Acea1sqU0nslENR7Nz+QIf4=
=0EgW
-END PGP SIGNATURE-
From 0e9d2531f3e6b6d9f4bf7b71f6661844a51eb661 Mon Sep 17 00:00:00 2001
From: Andrew G. Morgan [EMAIL PROTECTED]
Date: Thu, 31 Jan 2008 23:08:53 -0800
Subject: [PATCH] Implement per-process securebits

[This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES
 is enabled at configure time.]

Filesystem capability support makes it possible to do away with
(set)uid-0 based privilege and use capabilities instead. That is, with
filesystem support for capabilities but without this present patch,
it is (conceptually) possible to manage a system with capabilities
alone and never need to obtain privilege via (set)uid-0.

Of course, conceptually isn't quite the same as currently possible
since few user applications, certainly not enough to run a viable
system, are currently prepared to leverage capabilities to exercise
privilege. Further, many applications exist that may never get
upgraded in this way, and the kernel will continue to want to support
their setuid-0 base privilege needs.

Where pure-capability applications evolve and replace setuid-0
binaries, it is desirable that there be a mechanisms by which they
can contain their privilege. In addition to leveraging the per-process
bounding and inheritable sets, this should include suppressing the
privilege of the uid-0 superuser from the process' tree of children.

The feature added by this patch can be leveraged to suppress the
privilege associated with (set)uid-0. This suppression requires
CAP_SETPCAP to initiate, and only immediately affects the 'current'
process (it is inherited through fork()/exec()). This
reimplementation differs significantly from the historical support for
securebits which was system-wide, unwieldy and which has ultimately
withered to a dead relic in the source of the modern kernel.

With this patch applied a process, that is capable(CAP_SETPCAP), can
now drop all legacy privilege (through uid=0) for itself and all
subsequently fork()'d/exec()'d children with:

  prctl(PR_SET_SECUREBITS, 0x2f);

Applying the following patch to progs/capsh.c from libcap-2.05
adds support for this new prctl interface to capsh.c:

http://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/support-for-prctl-based-securebits.patch

Signed-off-by: Andrew G. Morgan [EMAIL PROTECTED]
Acked-by: Serge Hallyn [EMAIL PROTECTED]
---
 include/linux/capability.h |3 +-
 include/linux/init_task.h  |3 +-
 include/linux/prctl.h  |9 +++-
 include/linux/sched.h  |3 +-
 include/linux/securebits.h |   25 ---
 include/linux/security.h   |   14 +++---
 kernel/sys.c   |   25 +--
 security/capability.c  |1 +
 security/commoncap.c   |  103 
 security/dummy.c   |2 +-
 security/security.c|4 +-
 security/selinux/hooks.c   |5 +-
 12 files changed, 139 insertions(+), 58 deletions(-)

diff --git a/include/linux/capability.h b/include/linux/capability.h
index 7d50ff6..eaab759 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -155,6 +155,7 @@ typedef struct kernel_cap_struct {
  *   Add any capability from current's capability bounding set
  *   to the current process' inheritable set
  *   Allow taking bits out of capability bounding set
+ *   Allow modification of the securebits for a process
  */
 
 #define CAP_SETPCAP  8
@@ -490,8 +491,6 @@ extern const kernel_cap_t __cap_init_eff_set;
 int capable(int cap);
 int __capable(struct task_struct *t, int cap);
 
-extern long cap_prctl_drop(unsigned long cap);
-
 #endif /* __KERNEL__ */
 
 #endif /* !_LINUX_CAPABILITY_H */
diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index b0fa0f2..81f5582 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -9,6 +9,7 @@
 #include linux/ipc.h
 #include linux/pid_namespace.h
 #include linux/user_namespace.h
+#include linux/securebits.h
 #include net/net_namespace.h
 
 #define INIT_FDTABLE \
@@ -170,7 +171,7 @@ extern struct group_info init_groups;
.cap_inheritable = CAP_INIT_INH_SET,\
.cap_permitted  = CAP_FULL_SET, \
.cap_bset   = CAP_INIT_BSET,\
-   .keep_capabilities = 0, \
+   

Re: [PATCH] per-process securebits

[serge]

Quoting Andrew G. Morgan ([EMAIL PROTECTED]):
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1

 Here is the patch to add per-process securebits.

 Its all code that lives inside the capability LSM and the new securebits
 implementation is only active if CONFIG_SECURITY_FILE_CAPABILITIES is
 enabled (it doesn't make much sense to support this feature without
 filesystem capabilities).

 The patch assumes the CAP_SETPCAP fix of last week, but is otherwise on
 top of 2.6.24-rc8-mm1.

Hey Andrew,  I'm about to set up some ltp tests, but noticed the
following patch is needed on top of yours.

-serge

From feac61b47be8375e25b0f6ee876cf096c8b1b9cc Mon Sep 17 00:00:00 2001
From: Serge E. Hallyn [EMAIL PROTECTED]
Date: Fri, 1 Feb 2008 14:13:29 +
Subject: [PATCH 1/1] per-process securebits: security_task_prctl takes a long

Fix a mismatch between prototypes and callers for the updated
security_task_prctl().  The newly introduced argument, error,
is a long, not an int.

Signed-off-by: Serge E. Hallyn [EMAIL PROTECTED]
---
 include/linux/security.h |8 
 security/commoncap.c |4 ++--
 security/dummy.c |2 +-
 security/security.c  |2 +-
 security/selinux/hooks.c |2 +-
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/include/linux/security.h b/include/linux/security.h
index c550079..c789a0d 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -63,7 +63,7 @@ extern int cap_task_post_setuid (uid_t old_ruid, uid_t 
old_euid, uid_t old_suid,
 extern void cap_task_reparent_to_init (struct task_struct *p);
 extern int cap_task_kill(struct task_struct *p, struct siginfo *info, int sig, 
u32 secid);
 extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
- unsigned long arg4, unsigned long arg5, int *rc_p);
+ unsigned long arg4, unsigned long arg5, long *rc_p);
 extern int cap_task_setscheduler (struct task_struct *p, int policy, struct 
sched_param *lp);
 extern int cap_task_setioprio (struct task_struct *p, int ioprio);
 extern int cap_task_setnice (struct task_struct *p, int nice);
@@ -1348,7 +1348,7 @@ struct security_operations {
int (*task_wait) (struct task_struct * p);
int (*task_prctl) (int option, unsigned long arg2,
   unsigned long arg3, unsigned long arg4,
-  unsigned long arg5, int *rc_p);
+  unsigned long arg5, long *rc_p);
void (*task_reparent_to_init) (struct task_struct * p);
void (*task_to_inode)(struct task_struct *p, struct inode *inode);
 
@@ -1602,7 +1602,7 @@ int security_task_kill(struct task_struct *p, struct 
siginfo *info,
int sig, u32 secid);
 int security_task_wait(struct task_struct *p);
 int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
-unsigned long arg4, unsigned long arg5, int *rc_p);
+unsigned long arg4, unsigned long arg5, long *rc_p);
 void security_task_reparent_to_init(struct task_struct *p);
 void security_task_to_inode(struct task_struct *p, struct inode *inode);
 int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
@@ -2151,7 +2151,7 @@ static inline int security_task_wait (struct task_struct 
*p)
 static inline int security_task_prctl (int option, unsigned long arg2,
   unsigned long arg3,
   unsigned long arg4,
-  unsigned long arg5, int *rc_p)
+  unsigned long arg5, long *rc_p)
 {
return 0;
 }
diff --git a/security/commoncap.c b/security/commoncap.c
index 9b87182..858387a 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -611,9 +611,9 @@ int cap_task_kill(struct task_struct *p, struct siginfo 
*info,
 #endif
 
 int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
-  unsigned long arg4, unsigned long arg5, int *rc_p)
+  unsigned long arg4, unsigned long arg5, long *rc_p)
 {
-   int error = 0;
+   long error = 0;
 
switch (option) {
case PR_CAPBSET_READ:
diff --git a/security/dummy.c b/security/dummy.c
index c9e6d9f..e79f988 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -595,7 +595,7 @@ static int dummy_task_kill (struct task_struct *p, struct 
siginfo *info,
 }
 
 static int dummy_task_prctl (int option, unsigned long arg2, unsigned long 
arg3,
-unsigned long arg4, unsigned long arg5, int *rc_p)
+unsigned long arg4, unsigned long arg5, long *rc_p)
 {
return 0;
 }
diff --git a/security/security.c b/security/security.c
index c3cc14e..6f53155 100644
--- a/security/security.c
+++ b/security/security.c
@@ -683,7 +683,7 @@ int security_task_wait(struct task_struct *p)
 }
 
 int security_task_prctl(int option, unsigned 

Re: [PATCH] per-process securebits

[Serge E. Hallyn]

Quoting Andrew G. Morgan ([EMAIL PROTECTED]):
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1

 Here is the patch adding per-process secure-bits. This patch was
 generated over 2.6.24-rc8-mm1 + my privilege escalation bugfix.

 Cheers

 Andrew

 Ref: 6a63d67f37e50dd2031b3a050ebac1e64eae916e
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v1.2.6 (GNU/Linux)

 iD8DBQFHoXKG+bHCR3gb8jsRAon4AJ9bGGOjHhzxpgiGdShkcjEYr1+vUwCeJPYh
 YqNC8gHO/Kx4ST61G6ZwTXA=
 =2fdu
 -END PGP SIGNATURE-

 From 6a63d67f37e50dd2031b3a050ebac1e64eae916e Mon Sep 17 00:00:00 2001
 From: Andrew G. Morgan [EMAIL PROTECTED]
 Date: Wed, 23 Jan 2008 23:45:21 -0800
 Subject: [PATCH] Implement per-process, prctl-based, securebits
 
 With filesystem capabilities it is now possible to do away with
 (set)uid-0 based privilege and use capabilities instead.
 
 Historically, this was first attempted with a kernel-global set of
 securebits. That implementation, however, proved problematic, and has
 slowly whithered in the kernel. Prior to this patch, there remained no
 interface for manipulating the securebits - and thus no interface for
 suppressing root as all-capable.
 
 This patch reimplements securebits, with bit locking, as a per-process
 value. (To avoid increasing the per-task footprint of this change,
 I've merged the implementation of the per-process keep_capabilities
 bit with the per-process securebits value.)
 
 A process can now drop all legacy privilege (through uid=0), for
 itself and all of its fork()'d/exec()'d children with:
 
   prctl(PR_SET_SECUREBITS, 0x2f);
 
 Signed-off-by: Andrew G. Morgan [EMAIL PROTECTED]
 
 PS. Applying the following patch to progs/capsh.c from libcap-2.05
 adds support for this new prctl interface to capsh.c:
 
 http://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/support-for-prctl-based-securebits.patch
 ---
  include/linux/capability.h |3 +-
  include/linux/init_task.h  |3 +-
  include/linux/prctl.h  |9 +++-
  include/linux/sched.h  |3 +-
  include/linux/securebits.h |   25 ---
  include/linux/security.h   |   14 +++---
  kernel/sys.c   |   25 +--
  security/capability.c  |1 +
  security/commoncap.c   |  105 +++
  security/dummy.c   |2 +-
  security/security.c|4 +-
  security/selinux/hooks.c   |5 +-
  12 files changed, 140 insertions(+), 59 deletions(-)
 
 diff --git a/include/linux/capability.h b/include/linux/capability.h
 index 7d50ff6..eaab759 100644
 --- a/include/linux/capability.h
 +++ b/include/linux/capability.h
 @@ -155,6 +155,7 @@ typedef struct kernel_cap_struct {
   *   Add any capability from current's capability bounding set
   *   to the current process' inheritable set
   *   Allow taking bits out of capability bounding set
 + *   Allow modification of the securebits for a process
   */
  
  #define CAP_SETPCAP  8
 @@ -490,8 +491,6 @@ extern const kernel_cap_t __cap_init_eff_set;
  int capable(int cap);
  int __capable(struct task_struct *t, int cap);
  
 -extern long cap_prctl_drop(unsigned long cap);
 -
  #endif /* __KERNEL__ */
  
  #endif /* !_LINUX_CAPABILITY_H */
 diff --git a/include/linux/init_task.h b/include/linux/init_task.h
 index b0fa0f2..81f5582 100644
 --- a/include/linux/init_task.h
 +++ b/include/linux/init_task.h
 @@ -9,6 +9,7 @@
  #include linux/ipc.h
  #include linux/pid_namespace.h
  #include linux/user_namespace.h
 +#include linux/securebits.h
  #include net/net_namespace.h
  
  #define INIT_FDTABLE \
 @@ -170,7 +171,7 @@ extern struct group_info init_groups;
   .cap_inheritable = CAP_INIT_INH_SET,\
   .cap_permitted  = CAP_FULL_SET, \
   .cap_bset   = CAP_INIT_BSET,\
 - .keep_capabilities = 0, \
 + .securebits = SECUREBITS_DEFAULT,   \
   .user   = INIT_USER,\
   .comm   = swapper,\
   .thread = INIT_THREAD,  \
 diff --git a/include/linux/prctl.h b/include/linux/prctl.h
 index 3800639..b6c15cc 100644
 --- a/include/linux/prctl.h
 +++ b/include/linux/prctl.h
 @@ -16,7 +16,8 @@
  # define PR_UNALIGN_NOPRINT  1   /* silently fix up unaligned user 
 accesses */
  # define PR_UNALIGN_SIGBUS   2   /* generate SIGBUS on unaligned user 
 access */
  
 -/* Get/set whether or not to drop capabilities on setuid() away from uid 0 */
 +/* Get/set whether or not to drop capabilities on setuid() away from
 + * uid 0 (as per security/commoncap.c) */
  #define PR_GET_KEEPCAPS   7
  #define PR_SET_KEEPCAPS   8
  
 @@ -63,8 +64,12 @@
  #define PR_GET_SECCOMP   21
  #define PR_SET_SECCOMP   22
  
 -/* Get/set the capability bounding set */
 +/* Get/set the capability bounding set (as per 

Re: [PATCH] per-process securebits

[Serge E. Hallyn]

Quoting Andrew G. Morgan ([EMAIL PROTECTED]):
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1

 Andrew,

 Just to be clear, I'm not sure I agree that I'm hiding anything!

 I've tried very hard to limit this functionality to only being enabled
 if the still experimental LSM CONFIG_SECURITY_FILE_CAPABILITIES is yes.
 I've also arranged for all of the relevant support code to be inside an 
 LSM.

 However, I'll do as you say - extend the comment and fix the thinko
 pointed out by Serge, and resubmit to more than the LSM list.

Cool, I'd certainly say it's ready, and please feel free to add

Acked-by: Serge Hallyn [EMAIL PROTECTED]

at this point.  Of course Andrew Morton's fears are not uncalled for,
the whole trouble with subtle security interactions is that they're
subtle :) and easy to miss.  For what it's worth I'll run a few ltp
tests against your next version and try to verify that there are no
changes, and no changes when composed with selinux.

thanks,
-serge


 Cheers

 Andrew

 Andrew Morton wrote:
 | On Wed, 30 Jan 2008 23:02:30 -0800 Andrew G. Morgan
 [EMAIL PROTECTED] wrote:
 |
 | With filesystem capabilities it is now possible to do away with
 | (set)uid-0 based privilege and use capabilities instead.
 |
 | Historically, this was first attempted with a kernel-global set of
 | securebits. That implementation, however, proved problematic, and has
 | slowly whithered in the kernel. Prior to this patch, there remained no
 | interface for manipulating the securebits - and thus no interface for
 | suppressing root as all-capable.
 |
 | This patch reimplements securebits, with bit locking, as a per-process
 | value. (To avoid increasing the per-task footprint of this change,
 | I've merged the implementation of the per-process keep_capabilities
 | bit with the per-process securebits value.)
 |
 | A process can now drop all legacy privilege (through uid=0), for
 | itself and all of its fork()'d/exec()'d children with:
 |
 |   prctl(PR_SET_SECUREBITS, 0x2f);
 |
 |
 | This is the sort of patch which strikes terror into many hearts.  Please,
 | it cannot be hidden over on the lsm list.  I'll assume that this
 version is
 | an rfc/rfr for now and will cheerily delete it.
 |
 | For the next version, please do circulate it more widely.  It will
 need careful
 | explanation and review.
 |
 | I think it would be useful for this patch's changelog to give us a little
 | recap of what went wrong with capabilities, if that's possible (and if
 it's
 | relevant).  What was the bug which caused us to cripple capability
 | inheritance (some sendmail thing?) and why was that bug considered
 unfixable
 | at the time and by what means does this new code avoid the same old bug?
 |
 | A bit more changelog-for-dummies would be nice, too.  This particular
 dummy
 | doesn't understand why/how fs-caps made it possible for us to start using
 | capabilities properly.
 |
 | And last, but by no means least: s/whither/wither/ ;)
 |
 | Thanks.
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v1.2.6 (GNU/Linux)

 iD8DBQFHofxO+bHCR3gb8jsRAvc5AJwPa2+mcPg+mZDsDaXnhGunQCYKdwCgkuG6
 1UUWHCnsYZOXEPOPjRimKN8=
 =aE7E
 -END PGP SIGNATURE-
 -
 To unsubscribe from this list: send the line unsubscribe 
 linux-security-module in
 the body of a message to [EMAIL PROTECTED]
 More majordomo info at  http://vger.kernel.org/majordomo-info.html
-
To unsubscribe from this list: send the line unsubscribe 
linux-security-module in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [RFC PATCH] per-process securebits

[Serge E. Hallyn]

Quoting Andrew G. Morgan ([EMAIL PROTECTED]):
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1



 [EMAIL PROTECTED] wrote:
 | Quoting Andrew G. Morgan ([EMAIL PROTECTED]):
 | Here is my latest per-process secure-bits patch.
 |
 | Hey Andrew,
 |
 | looks really good.  Two comments inline.

 Thanks for the review!

 - -   unsigned keep_capabilities:1;
 + unsigned securebits;

 | should this maybe be an unsigned short?

 I'm not sure what this would buy us. Given the placement in the data
 structure its going to end up aligned by the surrounding data types and
 will occupy at least a sizeof(unsigned) amount of space even if we
 declare it as a short. Could you clarify why you think a short would be
 better?

Is that true on all architectures?  I figured there must be some
architecture where it isn't, but if not then never mind.


 + case PR_GET_KEEPCAPS:
 + if (issecure(SECURE_KEEP_CAPS))
 + error = 1;
 + break;
 + case PR_SET_KEEPCAPS:
 + if ((arg2  1)  !issecure(SECURE_KEEP_CAPS_LOCKED))

 | I don't understand what you're doing here.  If I had to guess, I'd say
 | you're only enforcing a check on a valid arg2 (which is 0 or 1) only if
 | SECURE_KEEP_CAPS_LOCKED is not set since otherwise the value you can't
 | be changed?  But you don't enforce that so it can in fact be changed,
 | and even if you did this seems to give the user poor feedback in more 
 than
 | one case, so it seems nicer to do

 I think the long and the short of it was that I clearly got distracted
 when writing that code! It didn't help that all of my testing was with
 the PR_*_SECUREBITS prctl()... What I had meant to write was this:

   case PR_SET_KEEPCAPS:
   /* Note, we rely on arg2 being unsigned here: */
   if ((arg2  1) || issecure(SECURE_KEEP_CAPS_LOCKED))
   error = -EINVAL;
   else
   current-securebits
   = (current-securebits
   ~issecure_mask(SECURE_KEEP_CAPS))
   | (arg2  SECURE_KEEP_CAPS);
   break;

 | if (arg2  1)
 | return -EINVAL;
 | if (issecure(SECURE_KEEP_CAPS_LOCKED))
 | return -EPERM;

 + error = -EINVAL;
 + else
 + current-securebits
 + = (current-securebits
 + ~issecure_mask(SECURE_KEEP_CAPS))
 + | (arg2 * issecure_mask(SECURE_KEEP_CAPS));

 | Seems overly baroque, and since you're not checking arg21 if
 | SECURE_KEEP_CAPS_LOCKED was set, this could actually set a wrong bit
 | with the multiplication.  After the above checks a simple

 | if (arg2)
 | current-securebits |= issecure_mask(SECURE_KEEP_CAPS);
 | else
 | current-securebits = ~issecure_mask(SECURE_KEEP_CAPS);

 | would be much easier to read...

 I agree. Both that -EPERM is a better error for the locked case, and the
 subsequent if / else. So, I'll use that.

thanks,
-serge
-
To unsubscribe from this list: send the line unsubscribe 
linux-security-module in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] per-process securebits

[Andrew G. Morgan]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Here is the patch adding per-process secure-bits. This patch was
generated over 2.6.24-rc8-mm1 + my privilege escalation bugfix.

Cheers

Andrew

Ref: 6a63d67f37e50dd2031b3a050ebac1e64eae916e
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQFHoXKG+bHCR3gb8jsRAon4AJ9bGGOjHhzxpgiGdShkcjEYr1+vUwCeJPYh
YqNC8gHO/Kx4ST61G6ZwTXA=
=2fdu
-END PGP SIGNATURE-
From 6a63d67f37e50dd2031b3a050ebac1e64eae916e Mon Sep 17 00:00:00 2001
From: Andrew G. Morgan [EMAIL PROTECTED]
Date: Wed, 23 Jan 2008 23:45:21 -0800
Subject: [PATCH] Implement per-process, prctl-based, securebits

With filesystem capabilities it is now possible to do away with
(set)uid-0 based privilege and use capabilities instead.

Historically, this was first attempted with a kernel-global set of
securebits. That implementation, however, proved problematic, and has
slowly whithered in the kernel. Prior to this patch, there remained no
interface for manipulating the securebits - and thus no interface for
suppressing root as all-capable.

This patch reimplements securebits, with bit locking, as a per-process
value. (To avoid increasing the per-task footprint of this change,
I've merged the implementation of the per-process keep_capabilities
bit with the per-process securebits value.)

A process can now drop all legacy privilege (through uid=0), for
itself and all of its fork()'d/exec()'d children with:

  prctl(PR_SET_SECUREBITS, 0x2f);

Signed-off-by: Andrew G. Morgan [EMAIL PROTECTED]

PS. Applying the following patch to progs/capsh.c from libcap-2.05
adds support for this new prctl interface to capsh.c:

http://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/support-for-prctl-based-securebits.patch
---
 include/linux/capability.h |3 +-
 include/linux/init_task.h  |3 +-
 include/linux/prctl.h  |9 +++-
 include/linux/sched.h  |3 +-
 include/linux/securebits.h |   25 ---
 include/linux/security.h   |   14 +++---
 kernel/sys.c   |   25 +--
 security/capability.c  |1 +
 security/commoncap.c   |  105 +++
 security/dummy.c   |2 +-
 security/security.c|4 +-
 security/selinux/hooks.c   |5 +-
 12 files changed, 140 insertions(+), 59 deletions(-)

diff --git a/include/linux/capability.h b/include/linux/capability.h
index 7d50ff6..eaab759 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -155,6 +155,7 @@ typedef struct kernel_cap_struct {
  *   Add any capability from current's capability bounding set
  *   to the current process' inheritable set
  *   Allow taking bits out of capability bounding set
+ *   Allow modification of the securebits for a process
  */
 
 #define CAP_SETPCAP  8
@@ -490,8 +491,6 @@ extern const kernel_cap_t __cap_init_eff_set;
 int capable(int cap);
 int __capable(struct task_struct *t, int cap);
 
-extern long cap_prctl_drop(unsigned long cap);
-
 #endif /* __KERNEL__ */
 
 #endif /* !_LINUX_CAPABILITY_H */
diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index b0fa0f2..81f5582 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -9,6 +9,7 @@
 #include linux/ipc.h
 #include linux/pid_namespace.h
 #include linux/user_namespace.h
+#include linux/securebits.h
 #include net/net_namespace.h
 
 #define INIT_FDTABLE \
@@ -170,7 +171,7 @@ extern struct group_info init_groups;
.cap_inheritable = CAP_INIT_INH_SET,\
.cap_permitted  = CAP_FULL_SET, \
.cap_bset   = CAP_INIT_BSET,\
-   .keep_capabilities = 0, \
+   .securebits = SECUREBITS_DEFAULT,   \
.user   = INIT_USER,\
.comm   = swapper,\
.thread = INIT_THREAD,  \
diff --git a/include/linux/prctl.h b/include/linux/prctl.h
index 3800639..b6c15cc 100644
--- a/include/linux/prctl.h
+++ b/include/linux/prctl.h
@@ -16,7 +16,8 @@
 # define PR_UNALIGN_NOPRINT1   /* silently fix up unaligned user 
accesses */
 # define PR_UNALIGN_SIGBUS 2   /* generate SIGBUS on unaligned user 
access */
 
-/* Get/set whether or not to drop capabilities on setuid() away from uid 0 */
+/* Get/set whether or not to drop capabilities on setuid() away from
+ * uid 0 (as per security/commoncap.c) */
 #define PR_GET_KEEPCAPS   7
 #define PR_SET_KEEPCAPS   8
 
@@ -63,8 +64,12 @@
 #define PR_GET_SECCOMP 21
 #define PR_SET_SECCOMP 22
 
-/* Get/set the capability bounding set */
+/* Get/set the capability bounding set (as per security/commoncap.c) */
 #define PR_CAPBSET_READ 23
 #define PR_CAPBSET_DROP 24
 
+/* Get/set securebits (as per security/commoncap.c) */
+#define 

Re: [PATCH] per-process securebits

[Andrew Morton]

On Wed, 30 Jan 2008 23:02:30 -0800 Andrew G. Morgan [EMAIL PROTECTED] wrote:

 With filesystem capabilities it is now possible to do away with
 (set)uid-0 based privilege and use capabilities instead.
 
 Historically, this was first attempted with a kernel-global set of
 securebits. That implementation, however, proved problematic, and has
 slowly whithered in the kernel. Prior to this patch, there remained no
 interface for manipulating the securebits - and thus no interface for
 suppressing root as all-capable.
 
 This patch reimplements securebits, with bit locking, as a per-process
 value. (To avoid increasing the per-task footprint of this change,
 I've merged the implementation of the per-process keep_capabilities
 bit with the per-process securebits value.)
 
 A process can now drop all legacy privilege (through uid=0), for
 itself and all of its fork()'d/exec()'d children with:
 
   prctl(PR_SET_SECUREBITS, 0x2f);
 

This is the sort of patch which strikes terror into many hearts.  Please,
it cannot be hidden over on the lsm list.  I'll assume that this version is
an rfc/rfr for now and will cheerily delete it.

For the next version, please do circulate it more widely.  It will need careful
explanation and review.

I think it would be useful for this patch's changelog to give us a little
recap of what went wrong with capabilities, if that's possible (and if it's
relevant).  What was the bug which caused us to cripple capability
inheritance (some sendmail thing?) and why was that bug considered unfixable
at the time and by what means does this new code avoid the same old bug?

A bit more changelog-for-dummies would be nice, too.  This particular dummy
doesn't understand why/how fs-caps made it possible for us to start using
capabilities properly.

And last, but by no means least: s/whither/wither/ ;)

Thanks.
-
To unsubscribe from this list: send the line unsubscribe 
linux-security-module in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [RFC PATCH] per-process securebits

[serge]

Quoting Andrew G. Morgan ([EMAIL PROTECTED]):
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1

 Here is my latest per-process secure-bits patch.

Hey Andrew,

looks really good.  Two comments inline.

 Cheers

 Andrew
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v1.2.6 (GNU/Linux)

 iD8DBQFHmg44+bHCR3gb8jsRAqPoAJ9IrlrQLKNcw8c4T0pgCmn/Lcng7wCfYjVI
 Tu1ufhQCjaMjuUizjJuMvrM=
 =NiGN
 -END PGP SIGNATURE-

 From 16fe33a1f6ab9957c83d4e74b67a25f920f2e7ba Mon Sep 17 00:00:00 2001
 From: Andrew G. Morgan [EMAIL PROTECTED]
 Date: Wed, 23 Jan 2008 23:45:21 -0800
 Subject: [PATCH] Implement per-process, prctl-based, securebits
 
 With filesystem capabilities it is now possible to do away with
 (set)uid-0 based privilege and use capabilities instead.
 
 Historically, this was first attempted with a kernel-global set of
 securebits. That implementation, however, proved problematic, and has
 slowly whithered in the kernel. Prior to this patch, there remained no
 interface for manipulating the securebits - and thus no interface for
 suppressing root as all-capable.
 
 This patch reimplements securebits, with bit locking, as a per-process
 value. (To avoid increasing the per-task footprint of this change,
 I've merged the implementation of the per-process keep_capabilities
 bit with the per-process securebits value.)
 
 A process can now drop all legacy privilege (through uid=0), for
 itself and all of its fork()'d/exec()'d children with:
 
   prctl(PR_SET_SECUREBITS, 0x2f);
 
 Signed-off-by: Andrew G. Morgan [EMAIL PROTECTED]
 
 PS. Applying the following patch to progs/capsh.c from libcap-2.05
 adds support for this new prctl interface to capsh.c:
 
 http://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/support-for-prctl-based-securebits.patch
 ---
  include/linux/capability.h |3 +-
  include/linux/init_task.h  |3 +-
  include/linux/prctl.h  |9 +++-
  include/linux/sched.h  |3 +-
  include/linux/securebits.h |   25 ---
  include/linux/security.h   |   14 ---
  kernel/sys.c   |   25 +--
  security/capability.c  |1 +
  security/commoncap.c   |  101 
 
  security/dummy.c   |2 +-
  security/security.c|4 +-
  security/selinux/hooks.c   |5 +-
  12 files changed, 137 insertions(+), 58 deletions(-)
 
 diff --git a/include/linux/capability.h b/include/linux/capability.h
 index 7d50ff6..eaab759 100644
 --- a/include/linux/capability.h
 +++ b/include/linux/capability.h
 @@ -155,6 +155,7 @@ typedef struct kernel_cap_struct {
   *   Add any capability from current's capability bounding set
   *   to the current process' inheritable set
   *   Allow taking bits out of capability bounding set
 + *   Allow modification of the securebits for a process
   */
  
  #define CAP_SETPCAP  8
 @@ -490,8 +491,6 @@ extern const kernel_cap_t __cap_init_eff_set;
  int capable(int cap);
  int __capable(struct task_struct *t, int cap);
  
 -extern long cap_prctl_drop(unsigned long cap);
 -
  #endif /* __KERNEL__ */
  
  #endif /* !_LINUX_CAPABILITY_H */
 diff --git a/include/linux/init_task.h b/include/linux/init_task.h
 index b0fa0f2..81f5582 100644
 --- a/include/linux/init_task.h
 +++ b/include/linux/init_task.h
 @@ -9,6 +9,7 @@
  #include linux/ipc.h
  #include linux/pid_namespace.h
  #include linux/user_namespace.h
 +#include linux/securebits.h
  #include net/net_namespace.h
  
  #define INIT_FDTABLE \
 @@ -170,7 +171,7 @@ extern struct group_info init_groups;
   .cap_inheritable = CAP_INIT_INH_SET,\
   .cap_permitted  = CAP_FULL_SET, \
   .cap_bset   = CAP_INIT_BSET,\
 - .keep_capabilities = 0, \
 + .securebits = SECUREBITS_DEFAULT,   \
   .user   = INIT_USER,\
   .comm   = swapper,\
   .thread = INIT_THREAD,  \
 diff --git a/include/linux/prctl.h b/include/linux/prctl.h
 index 3800639..b6c15cc 100644
 --- a/include/linux/prctl.h
 +++ b/include/linux/prctl.h
 @@ -16,7 +16,8 @@
  # define PR_UNALIGN_NOPRINT  1   /* silently fix up unaligned user 
 accesses */
  # define PR_UNALIGN_SIGBUS   2   /* generate SIGBUS on unaligned user 
 access */
  
 -/* Get/set whether or not to drop capabilities on setuid() away from uid 0 */
 +/* Get/set whether or not to drop capabilities on setuid() away from
 + * uid 0 (as per security/commoncap.c) */
  #define PR_GET_KEEPCAPS   7
  #define PR_SET_KEEPCAPS   8
  
 @@ -63,8 +64,12 @@
  #define PR_GET_SECCOMP   21
  #define PR_SET_SECCOMP   22
  
 -/* Get/set the capability bounding set */
 +/* Get/set the capability bounding set (as per security/commoncap.c) */
  #define PR_CAPBSET_READ 23
  #define 

[RFC PATCH] per-process securebits

[Andrew G. Morgan]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Here is my latest per-process secure-bits patch.

Cheers

Andrew
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQFHmg44+bHCR3gb8jsRAqPoAJ9IrlrQLKNcw8c4T0pgCmn/Lcng7wCfYjVI
Tu1ufhQCjaMjuUizjJuMvrM=
=NiGN
-END PGP SIGNATURE-
From 16fe33a1f6ab9957c83d4e74b67a25f920f2e7ba Mon Sep 17 00:00:00 2001
From: Andrew G. Morgan [EMAIL PROTECTED]
Date: Wed, 23 Jan 2008 23:45:21 -0800
Subject: [PATCH] Implement per-process, prctl-based, securebits

With filesystem capabilities it is now possible to do away with
(set)uid-0 based privilege and use capabilities instead.

Historically, this was first attempted with a kernel-global set of
securebits. That implementation, however, proved problematic, and has
slowly whithered in the kernel. Prior to this patch, there remained no
interface for manipulating the securebits - and thus no interface for
suppressing root as all-capable.

This patch reimplements securebits, with bit locking, as a per-process
value. (To avoid increasing the per-task footprint of this change,
I've merged the implementation of the per-process keep_capabilities
bit with the per-process securebits value.)

A process can now drop all legacy privilege (through uid=0), for
itself and all of its fork()'d/exec()'d children with:

  prctl(PR_SET_SECUREBITS, 0x2f);

Signed-off-by: Andrew G. Morgan [EMAIL PROTECTED]

PS. Applying the following patch to progs/capsh.c from libcap-2.05
adds support for this new prctl interface to capsh.c:

http://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/support-for-prctl-based-securebits.patch
---
 include/linux/capability.h |3 +-
 include/linux/init_task.h  |3 +-
 include/linux/prctl.h  |9 +++-
 include/linux/sched.h  |3 +-
 include/linux/securebits.h |   25 ---
 include/linux/security.h   |   14 ---
 kernel/sys.c   |   25 +--
 security/capability.c  |1 +
 security/commoncap.c   |  101 
 security/dummy.c   |2 +-
 security/security.c|4 +-
 security/selinux/hooks.c   |5 +-
 12 files changed, 137 insertions(+), 58 deletions(-)

diff --git a/include/linux/capability.h b/include/linux/capability.h
index 7d50ff6..eaab759 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -155,6 +155,7 @@ typedef struct kernel_cap_struct {
  *   Add any capability from current's capability bounding set
  *   to the current process' inheritable set
  *   Allow taking bits out of capability bounding set
+ *   Allow modification of the securebits for a process
  */
 
 #define CAP_SETPCAP  8
@@ -490,8 +491,6 @@ extern const kernel_cap_t __cap_init_eff_set;
 int capable(int cap);
 int __capable(struct task_struct *t, int cap);
 
-extern long cap_prctl_drop(unsigned long cap);
-
 #endif /* __KERNEL__ */
 
 #endif /* !_LINUX_CAPABILITY_H */
diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index b0fa0f2..81f5582 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -9,6 +9,7 @@
 #include linux/ipc.h
 #include linux/pid_namespace.h
 #include linux/user_namespace.h
+#include linux/securebits.h
 #include net/net_namespace.h
 
 #define INIT_FDTABLE \
@@ -170,7 +171,7 @@ extern struct group_info init_groups;
.cap_inheritable = CAP_INIT_INH_SET,\
.cap_permitted  = CAP_FULL_SET, \
.cap_bset   = CAP_INIT_BSET,\
-   .keep_capabilities = 0, \
+   .securebits = SECUREBITS_DEFAULT,   \
.user   = INIT_USER,\
.comm   = swapper,\
.thread = INIT_THREAD,  \
diff --git a/include/linux/prctl.h b/include/linux/prctl.h
index 3800639..b6c15cc 100644
--- a/include/linux/prctl.h
+++ b/include/linux/prctl.h
@@ -16,7 +16,8 @@
 # define PR_UNALIGN_NOPRINT1   /* silently fix up unaligned user 
accesses */
 # define PR_UNALIGN_SIGBUS 2   /* generate SIGBUS on unaligned user 
access */
 
-/* Get/set whether or not to drop capabilities on setuid() away from uid 0 */
+/* Get/set whether or not to drop capabilities on setuid() away from
+ * uid 0 (as per security/commoncap.c) */
 #define PR_GET_KEEPCAPS   7
 #define PR_SET_KEEPCAPS   8
 
@@ -63,8 +64,12 @@
 #define PR_GET_SECCOMP 21
 #define PR_SET_SECCOMP 22
 
-/* Get/set the capability bounding set */
+/* Get/set the capability bounding set (as per security/commoncap.c) */
 #define PR_CAPBSET_READ 23
 #define PR_CAPBSET_DROP 24
 
+/* Get/set securebits (as per security/commoncap.c) */
+#define PR_GET_SECUREBITS 25
+#define PR_SET_SECUREBITS 26
+
 #endif /* _LINUX_PRCTL_H */
diff --git a/include/linux/sched.h b/include/linux/sched.h

Re: [RFC PATCH] per-process securebits

[Serge E. Hallyn]

Quoting Andrew G. Morgan ([EMAIL PROTECTED]):
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1

 Here is my latest per-process secure-bits patch.

Thanks Andrew, I'll check this out tonight or this weekend.

-serge


 Cheers

 Andrew
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v1.2.6 (GNU/Linux)

 iD8DBQFHmg44+bHCR3gb8jsRAqPoAJ9IrlrQLKNcw8c4T0pgCmn/Lcng7wCfYjVI
 Tu1ufhQCjaMjuUizjJuMvrM=
 =NiGN
 -END PGP SIGNATURE-

 From 16fe33a1f6ab9957c83d4e74b67a25f920f2e7ba Mon Sep 17 00:00:00 2001
 From: Andrew G. Morgan [EMAIL PROTECTED]
 Date: Wed, 23 Jan 2008 23:45:21 -0800
 Subject: [PATCH] Implement per-process, prctl-based, securebits
 
 With filesystem capabilities it is now possible to do away with
 (set)uid-0 based privilege and use capabilities instead.
 
 Historically, this was first attempted with a kernel-global set of
 securebits. That implementation, however, proved problematic, and has
 slowly whithered in the kernel. Prior to this patch, there remained no
 interface for manipulating the securebits - and thus no interface for
 suppressing root as all-capable.
 
 This patch reimplements securebits, with bit locking, as a per-process
 value. (To avoid increasing the per-task footprint of this change,
 I've merged the implementation of the per-process keep_capabilities
 bit with the per-process securebits value.)
 
 A process can now drop all legacy privilege (through uid=0), for
 itself and all of its fork()'d/exec()'d children with:
 
   prctl(PR_SET_SECUREBITS, 0x2f);
 
 Signed-off-by: Andrew G. Morgan [EMAIL PROTECTED]
 
 PS. Applying the following patch to progs/capsh.c from libcap-2.05
 adds support for this new prctl interface to capsh.c:
 
 http://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/support-for-prctl-based-securebits.patch
 ---
  include/linux/capability.h |3 +-
  include/linux/init_task.h  |3 +-
  include/linux/prctl.h  |9 +++-
  include/linux/sched.h  |3 +-
  include/linux/securebits.h |   25 ---
  include/linux/security.h   |   14 ---
  kernel/sys.c   |   25 +--
  security/capability.c  |1 +
  security/commoncap.c   |  101 
 
  security/dummy.c   |2 +-
  security/security.c|4 +-
  security/selinux/hooks.c   |5 +-
  12 files changed, 137 insertions(+), 58 deletions(-)
 
 diff --git a/include/linux/capability.h b/include/linux/capability.h
 index 7d50ff6..eaab759 100644
 --- a/include/linux/capability.h
 +++ b/include/linux/capability.h
 @@ -155,6 +155,7 @@ typedef struct kernel_cap_struct {
   *   Add any capability from current's capability bounding set
   *   to the current process' inheritable set
   *   Allow taking bits out of capability bounding set
 + *   Allow modification of the securebits for a process
   */
  
  #define CAP_SETPCAP  8
 @@ -490,8 +491,6 @@ extern const kernel_cap_t __cap_init_eff_set;
  int capable(int cap);
  int __capable(struct task_struct *t, int cap);
  
 -extern long cap_prctl_drop(unsigned long cap);
 -
  #endif /* __KERNEL__ */
  
  #endif /* !_LINUX_CAPABILITY_H */
 diff --git a/include/linux/init_task.h b/include/linux/init_task.h
 index b0fa0f2..81f5582 100644
 --- a/include/linux/init_task.h
 +++ b/include/linux/init_task.h
 @@ -9,6 +9,7 @@
  #include linux/ipc.h
  #include linux/pid_namespace.h
  #include linux/user_namespace.h
 +#include linux/securebits.h
  #include net/net_namespace.h
  
  #define INIT_FDTABLE \
 @@ -170,7 +171,7 @@ extern struct group_info init_groups;
   .cap_inheritable = CAP_INIT_INH_SET,\
   .cap_permitted  = CAP_FULL_SET, \
   .cap_bset   = CAP_INIT_BSET,\
 - .keep_capabilities = 0, \
 + .securebits = SECUREBITS_DEFAULT,   \
   .user   = INIT_USER,\
   .comm   = swapper,\
   .thread = INIT_THREAD,  \
 diff --git a/include/linux/prctl.h b/include/linux/prctl.h
 index 3800639..b6c15cc 100644
 --- a/include/linux/prctl.h
 +++ b/include/linux/prctl.h
 @@ -16,7 +16,8 @@
  # define PR_UNALIGN_NOPRINT  1   /* silently fix up unaligned user 
 accesses */
  # define PR_UNALIGN_SIGBUS   2   /* generate SIGBUS on unaligned user 
 access */
  
 -/* Get/set whether or not to drop capabilities on setuid() away from uid 0 */
 +/* Get/set whether or not to drop capabilities on setuid() away from
 + * uid 0 (as per security/commoncap.c) */
  #define PR_GET_KEEPCAPS   7
  #define PR_SET_KEEPCAPS   8
  
 @@ -63,8 +64,12 @@
  #define PR_GET_SECCOMP   21
  #define PR_SET_SECCOMP   22
  
 -/* Get/set the capability bounding set */
 +/* Get/set the capability bounding set (as per security/commoncap.c) */
  #define PR_CAPBSET_READ 23