[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190712121202.403b2f5f@jabberwock.cb.piermont.com>
Date: Fri, 12 Jul 2019 12:12:02 -0400
From: "Perry E. Metzger" <perry@...rmont.com>
To: Jordan Glover <Golden_Miller83@...tonmail.ch>
Cc: oss-security@...ts.openwall.com, Simon McVittie <smcv@...ian.org>
Subject: Re: Privileged File Access from Desktop Applications
On Fri, 12 Jul 2019 11:53:26 -0400 "Perry E. Metzger"
<perry@...rmont.com> wrote:
> > > What's the right way to handle this stuff? Capabilities,
> > > probably. It's what they're designed for.
> >
> > They're completely not designed for this case. Setting
> > CAP_DAC_OVERRIDE or CAP_SYS_ADMIN is very close to SUID root. See:
> > https://grsecurity.net/false_boundaries_and_arbitrary_code_execution.php
>
> Those aren't capabilities. Those are this POSIX mechanism that got
> the same name for no good reason and doesn't do anything like what
> an actual capability system does.
It occurs to me that people without a background in computer security
might not know what a capability actually is, or how a capability
based security system manages access control.
This Wikipedia page:
https://en.wikipedia.org/wiki/Capability-based_security
isn't the best, but it does have good pointers to real explanations.
For a look at how you can implement a capability system on top
of Unix, see Capsicum, which was built for FreeBSD but never actually
ported to Linux (which is sad and should be corrected):
https://www.cl.cam.ac.uk/research/security/capsicum/papers/2010usenix-security-capsicum-website.pdf
Note that a primitive form of capabilities can be achieved in the
current Linux kernel by passing file descriptors between processes, a
tool relatively few people seem to know exists. Given that the
"correct" mechanism (something like Capsicum) doesn't exist in Linux
yet, it's a poor man's second best. Again, porting Capsicum would be
the smart thing to do instead of all this ad hoc stuff.
Perry
--
Perry E. Metzger perry@...rmont.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
