replace suid with capabilities, for example in busybox
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest3 patches 0 repliesNew
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/3 | capabilities.bbclass: add file capabilities automaticallymeta/ | +58 | 0 replies | |
| 2/3 | busybox.inc: prepare for additional link filesmeta/ | +9 | 0 replies | |
| 3/3 | busybox_%.bbappend: run ping and traceroute with file capabilitiesmeta/ | +41 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH 0/3] replace suid with capabilities, for example in busybox
I started working on hardening a distro by replacing suid binaries with executables that add only the necessary capabilities via file capabilities. It is understood that this is often still a path towards privilege escalation (see
https://forums.grsecurity.net/viewtopic.php?f=7&t=2522&sid=c6fbcf62fd5d3472562540a7e608ce4e#p10271)
but as part of a defense-in-depth strategy it's still useful.
I'd like to get the first two patches reviewed and, if seen as useful, merged into master.
The busybox_%.bbappend is just an example how this would be used. It's not meant to be merged.
There's currently one caveat: the file capabilities do not get copied into images. I see them under pseudo (with getcap, filecap and as security.capability xattr with getfattr), but they do not get copied into an ext4 image by mkfs.ext4.
Robert, I tried that with the patched e2fsprogs from meta-selinux. Is that perhaps something you can look into as part of
https://bugzilla.yoctoproject.org/show_bug.cgi?id=8622 ?
Actually, I just noticed another problem with that e2fsprogs version:
with Smack enabled via meta-intel-iot-security/meta-security-smack, /etc has under pseudo:
# getfattr -d -m . rootfs/etc/ # file: ../rootfs/etc/ security.SMACK64="System::Shared" security.SMACK64TRANSMUTE="TRUE"
A loop-mounted ext4 image only has one xattr:
security.SMACK64TRANSMUTE="TRUE"
The following changes since commit 192da885e92d3b163b9c4e6b8151c9ecc6062b14:
build-appliance-image: Update to master head revision (2015-12-09 08:49:13 +0000)
are available in the git repository at:
git://github.com/pohly/openembedded-core capabilities
https://github.com/pohly/openembedded-core/tree/capabilities
Patrick Ohly (3):
capabilities.bbclass: add file capabilities automatically busybox.inc: prepare for additional link files busybox_%.bbappend: run ping and traceroute with file capabilities
meta/classes/capabilities.bbclass | 58 ++++++++++++++++++++++++++++ meta/recipes-core/busybox/busybox.inc | 16 ++++---- meta/recipes-core/busybox/busybox_%.bbappend | 41 ++++++++++++++++++++ 3 files changed, 108 insertions(+), 7 deletions(-) create mode 100644 meta/classes/capabilities.bbclass create mode 100644 meta/recipes-core/busybox/busybox_%.bbappend
Signature · 1 line
2.1.4