Gentoo Archives: gentoo-dev

From: Constanze Hausner <constanze@g.o>
To: gentoo-dev@l.g.o
Subject: Re: [gentoo-dev] eclass for handling of file-based capabilities
Date: Sat, 16 Apr 2011 16:03:40
Message-Id: 20110416160443.GA22401@totoro.lan.kfr
In Reply to: Re: [gentoo-dev] eclass for handling of file-based capabilities by Constanze Hausner
> > I'd take a different approach here; this code basically assumes that > > the PM knows of it- note the chmod -s. The use flag protection you > > tried adding, without some profile hacks, is user modifiable- meaning > > users can flip it on even if the PM doesn't support it. > > > > Or consider that the code above is purely doing it's thing during the > > install phase, specifically against whatever filesystem is used for > > building- while capabilities might be able to be set there, it's > > possible the final merge location won't support it. End result of > > that is you'll get a setuid stripped binary merged to the > > livefs lacking the caps- borkage. Or consider the inverse- the > > buildroot can't do capabilities, but the livefs could. You get the > > idea. > > > > Instead, write the code so the PM has to export a marker in some > > fashion to explicitly state "yes, I can do capabilities"- I'm > > specifically suggestining checking for a callback function exposed to > > the env. > > > > If that function isn't there, then the PM can't do it- end of story. > > If it is, the PM takes the args and will try to apply the > > capabilities at the correct time- stripping setuid/setgid if it > > succeeds. > > > > Please go that route; and please do not stick "portage" into the > > function name, something generic we can use for a later EAPI is > > better. > > > > Implementing it as I suggested has the nice side affect of not being > > limited by PMS also, although it's an approach that still requires > > planning for compatibility. > I'm currently in search of a good fallback mechanism respectivly a good > mechanism to deal with cap-setting in src_install. As I already said in > my mail to ciaran, I'm going to give the new ideas some thought :).
After some discussions with ferringb we came to the conclusion, that his proposal to implement the cap-setting function in the PMS would be for the best ;). So for supporting filebased-caps, we need all PMS to provide a function which: - gets the final path and the caps to set, tries to set them and then removes the suid-bit - returns 0 or 1, indicating success or failure If the user's setting doesn't allow caps, then the function is not available. Additionally we could also pass the fallback-filemode to the PMS, so it could do the suid-setting itself, but this would be optional. So PMS-Guys, please tell me what you think about that and if I can help in any way. Filebased-caps could really help to have more secure systems :). btw, the eclass will be adapted, of course ;). Cheers, Constanze