Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 1f29fae29709b4668979e244c09b2fa78ff1ad59

Authored by Serge E. Hallyn
Committed by James Morris
1 parent e21e696edb
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

file capabilities: add no_file_caps switch (v4) 

Add a no_file_caps boot option when file capabilities are
compiled into the kernel (CONFIG_SECURITY_FILE_CAPABILITIES=y).

This allows distributions to ship a kernel with file capabilities
compiled in, without forcing users to use (and understand and
trust) them.

When no_file_caps is specified at boot, then when a process executes
a file, any file capabilities stored with that file will not be
used in the calculation of the process' new capability sets.

This means that booting with the no_file_caps boot option will
not be the same as booting a kernel with file capabilities
compiled out - in particular a task with  CAP_SETPCAP will not
have any chance of passing capabilities to another task (which
isn't "really" possible anyway, and which may soon by killed
altogether by David Howells in any case), and it will instead
be able to put new capabilities in its pI.  However since fI
will always be empty and pI is masked with fI, it gains the
task nothing.

We also support the extra prctl options, setting securebits and
dropping capabilities from the per-process bounding set.

The other remaining difference is that killpriv, task_setscheduler,
setioprio, and setnice will continue to be hooked.  That will
be noticable in the case where a root task changed its uid
while keeping some caps, and another task owned by the new uid
tries to change settings for the more privileged task.

Changelog:
	Nov 05 2008: (v4) trivial port on top of always-start-\
		with-clear-caps patch
	Sep 23 2008: nixed file_caps_enabled when file caps are
		not compiled in as it isn't used.
		Document no_file_caps in kernel-parameters.txt.

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Signed-off-by: James Morris <jmorris@namei.org>

Showing 4 changed files with 21 additions and 0 deletions Side-by-side Diff

Documentation/kernel-parameters.txt
Diff comments   View file @ 1f29fae
... ... @@ -1459,6 +1459,10 @@
1459 1459 instruction doesn't work correctly and not to
1460 1460 use it.
1461 1461  
  1462 + no_file_caps Tells the kernel not to honor file capabilities. The
  1463 + only way then for a file to be executed with privilege
  1464 + is to be setuid root or executed by root.
  1465 +
1462 1466 nohalt [IA-64] Tells the kernel not to use the power saving
1463 1467 function PAL_HALT_LIGHT when idle. This increases
1464 1468 power-consumption. On the positive side, it reduces
include/linux/capability.h
Diff comments   View file @ 1f29fae
... ... @@ -68,6 +68,9 @@
68 68 #define VFS_CAP_U32 VFS_CAP_U32_2
69 69 #define VFS_CAP_REVISION VFS_CAP_REVISION_2
70 70  
  71 +#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
  72 +extern int file_caps_enabled;
  73 +#endif
71 74  
72 75 struct vfs_cap_data {
73 76 __le32 magic_etc; /* Little endian */
... ... @@ -33,6 +33,17 @@
33 33 EXPORT_SYMBOL(__cap_full_set);
34 34 EXPORT_SYMBOL(__cap_init_eff_set);
35 35  
  36 +#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
  37 +int file_caps_enabled = 1;
  38 +
  39 +static int __init file_caps_disable(char *str)
  40 +{
  41 + file_caps_enabled = 0;
  42 + return 1;
  43 +}
  44 +__setup("no_file_caps", file_caps_disable);
  45 +#endif
  46 +
36 47 /*
37 48 * More recent versions of libcap are available from:
38 49 *
security/commoncap.c
Diff comments   View file @ 1f29fae
... ... @@ -281,6 +281,9 @@
281 281  
282 282 bprm_clear_caps(bprm);
283 283  
  284 + if (!file_caps_enabled)
  285 + return 0;
  286 +
284 287 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
285 288 return 0;
286 289