Re: [RFC PATCH 1/2] security, capabilities: create CAP_TRUSTED

[off-list ref],linux-ext4-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,linux-f2fs-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org,linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,linux-mtd-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org,jfs-discussion-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org,ocfs2-devel-N0ozoZBvEnrZJqsBc5GL+g@public.gmane.org,linux-unionfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,reiserfs-devel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org,linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,kernel-hardening-ZwoEplunGu1jrUoiu81ncdBPR1lH4CV8@public.gmane.org
From: Nicolas Belouin <redacted>
Message-ID: [off-list ref]



On October 21, 2017 6:03:02 PM GMT+02:00, "Serge E. Hallyn" [off-list ref] wrote:

Quoting Nicolas Belouin (nicolas-6zwZCx3K5ONGWvitb5QawA@public.gmane.org):

quoted

with CAP_SYS_ADMIN being bloated, the usefulness of using it to
flag a process to be entrusted for e.g reading and writing trusted
xattr is near zero.
CAP_TRUSTED aims to provide userland with a way to mark a process as
entrusted to do specific (not specially admin-centered) actions. It
would for example allow a process to red/write the trusted xattrs.

You say "for example".  Are you intending to add more uses?  If so,
what
are they?  If not, how about renaming it CAP_TRUSTED_XATTR?

I don't see any other use for now, but I don't want it to be too narrow and non usable in a similar context in the future. So I believe the underlying purpose of marking a process as "trusted" (even if for now it only means rw permission on trusted xattr) is more meaningful.

What all does allowing writes to trusted xattrs give you?  There are
the overlayfs whiteouts, what else?

Nicolas