aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSerge E. Hallyn <serue@us.ibm.com>2008-11-05 17:08:52 -0500
committerJames Morris <jmorris@namei.org>2008-11-05 18:14:51 -0500
commit1f29fae29709b4668979e244c09b2fa78ff1ad59 (patch)
treed50129066cd1f131551eb364d04542dfcf923050
parente21e696edb498c7f7eed42ba3096f6bbe13927b6 (diff)
file capabilities: add no_file_caps switch (v4)
Add a no_file_caps boot option when file capabilities are compiled into the kernel (CONFIG_SECURITY_FILE_CAPABILITIES=y). This allows distributions to ship a kernel with file capabilities compiled in, without forcing users to use (and understand and trust) them. When no_file_caps is specified at boot, then when a process executes a file, any file capabilities stored with that file will not be used in the calculation of the process' new capability sets. This means that booting with the no_file_caps boot option will not be the same as booting a kernel with file capabilities compiled out - in particular a task with CAP_SETPCAP will not have any chance of passing capabilities to another task (which isn't "really" possible anyway, and which may soon by killed altogether by David Howells in any case), and it will instead be able to put new capabilities in its pI. However since fI will always be empty and pI is masked with fI, it gains the task nothing. We also support the extra prctl options, setting securebits and dropping capabilities from the per-process bounding set. The other remaining difference is that killpriv, task_setscheduler, setioprio, and setnice will continue to be hooked. That will be noticable in the case where a root task changed its uid while keeping some caps, and another task owned by the new uid tries to change settings for the more privileged task. Changelog: Nov 05 2008: (v4) trivial port on top of always-start-\ with-clear-caps patch Sep 23 2008: nixed file_caps_enabled when file caps are not compiled in as it isn't used. Document no_file_caps in kernel-parameters.txt. Signed-off-by: Serge Hallyn <serue@us.ibm.com> Acked-by: Andrew G. Morgan <morgan@kernel.org> Signed-off-by: James Morris <jmorris@namei.org>
-rw-r--r--Documentation/kernel-parameters.txt4
-rw-r--r--include/linux/capability.h3
-rw-r--r--kernel/capability.c11
-rw-r--r--security/commoncap.c3
4 files changed, 21 insertions, 0 deletions
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 1bbcaa8982b6..784443acca9c 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1459,6 +1459,10 @@ and is between 256 and 4096 characters. It is defined in the file
1459 instruction doesn't work correctly and not to 1459 instruction doesn't work correctly and not to
1460 use it. 1460 use it.
1461 1461
1462 no_file_caps Tells the kernel not to honor file capabilities. The
1463 only way then for a file to be executed with privilege
1464 is to be setuid root or executed by root.
1465
1462 nohalt [IA-64] Tells the kernel not to use the power saving 1466 nohalt [IA-64] Tells the kernel not to use the power saving
1463 function PAL_HALT_LIGHT when idle. This increases 1467 function PAL_HALT_LIGHT when idle. This increases
1464 power-consumption. On the positive side, it reduces 1468 power-consumption. On the positive side, it reduces
diff --git a/include/linux/capability.h b/include/linux/capability.h
index 9d1fe30b6f6c..5bc145bd759a 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -68,6 +68,9 @@ typedef struct __user_cap_data_struct {
68#define VFS_CAP_U32 VFS_CAP_U32_2 68#define VFS_CAP_U32 VFS_CAP_U32_2
69#define VFS_CAP_REVISION VFS_CAP_REVISION_2 69#define VFS_CAP_REVISION VFS_CAP_REVISION_2
70 70
71#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
72extern int file_caps_enabled;
73#endif
71 74
72struct vfs_cap_data { 75struct vfs_cap_data {
73 __le32 magic_etc; /* Little endian */ 76 __le32 magic_etc; /* Little endian */
diff --git a/kernel/capability.c b/kernel/capability.c
index 33e51e78c2d8..e13a68535ad5 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -33,6 +33,17 @@ EXPORT_SYMBOL(__cap_empty_set);
33EXPORT_SYMBOL(__cap_full_set); 33EXPORT_SYMBOL(__cap_full_set);
34EXPORT_SYMBOL(__cap_init_eff_set); 34EXPORT_SYMBOL(__cap_init_eff_set);
35 35
36#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
37int file_caps_enabled = 1;
38
39static int __init file_caps_disable(char *str)
40{
41 file_caps_enabled = 0;
42 return 1;
43}
44__setup("no_file_caps", file_caps_disable);
45#endif
46
36/* 47/*
37 * More recent versions of libcap are available from: 48 * More recent versions of libcap are available from:
38 * 49 *
diff --git a/security/commoncap.c b/security/commoncap.c
index 3976613db829..f88119cb2bc2 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -281,6 +281,9 @@ static int get_file_caps(struct linux_binprm *bprm)
281 281
282 bprm_clear_caps(bprm); 282 bprm_clear_caps(bprm);
283 283
284 if (!file_caps_enabled)
285 return 0;
286
284 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) 287 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
285 return 0; 288 return 0;
286 289