Re: [gentoo-dev] turning off a default compile option

[Joshua Brindle]

Grant Goodyear wrote:

>>The user would like a way to disable linux compatability if your kernel
>>does not support it by using the 'caps' use flag. Maybe I dont fully
>>understand 'linux compatability' but if we're all running Gentoo, arent
>>we all running linux in the first place?
>
>
> It's "capabilities", not "compatability [sic]".  My understanding
> is that capabilities allow for partitioning of root's all-powerful
> nature into fine-grained permissions.  Thus, obtaining root is no longer
> sufficient to do massive harm.  I believe this notion is central to
> selinux, but I'm not sure if anything else uses it at the moment.
>
>
capabilities predates selinux and pretty much every other modern ACL/MAC 
  system. You are correct about the purpose of capabilities though, the 
general use of them is to start up an app as root, like a daemon, do 
what it needs (bind < 1024, chroot, etc) and then drop capabilities that 
it does not need. At that point it's still running as root (uid=0) but 
doesn't have the ability to, for example, override dac controls or 
reconfigure network devices or reboot the system)

>>My problem surfaces: Bind enables 'linux compatability' by default.
>>Gentoo does have a linux compability flag (caps), but this is only to
>>ENABLE linux compatability, not to disable it. I attempted to use the
>>bugger's suggestion, but repoman got pissed on a full scan. Grant
>>mentioned maybe making 'caps' part of the default use flag.
>
>
> Actually, what I said is that capabilities should be disabled _unless_
> USE=caps, and that if there seemed to be a broad need for capabilities
> for our users then we might want to discuss making it a default USE
> flag.
>
capabilities should _never_ be disabled in an application, there is no 
reason for this, it's absolute silliness. Not only does capabilities add 
  badly needed security to many apps but it's available in all linux 
kernels. There is an LSM capabilities module that may be confusing some 
people, more on this in a sec.

>
>>Basically I'd like a way of using a "reverse" use flag, -caps, and if
>>-caps is set, disable linux compat; if the flag is not set, do not add
>>any --config-option at all.
>
>
> I don't think a reverse flag is needed here.  The fact that bind only
> has a --disable setting for capabilities and not an --enable is a bit
> odd, but it doesn't require us to change how our USE flags work.  If
> USE=caps, then no flag needs to be sent to configure (but comment the
> ebuild so there's a record that bind's configure is warped), but if
> "caps" is not in USE, then send the --disable.
>
ok, grepping through the tree I see gnupg using this flag which doesn't 
actually enable/disable the use of capabilities but makes it aware of 
them. There may be other places where disabling capabilities may be 
acceptable risk for real time apps or something like that (i see 
jack-audio-connection-kit has the ability to explicitly enable them

use caps && myconf="${myconf} --enable-capabilities --enable-stripped-jackd"

The logic seems wrong there but I don't even know what that app does so 
I don't care.


Now then, about LSM.. Capabilities are still hard coded into the kernel 
if you do _NOT_ use LSM (ie: selinux). That means every single Linux 
kernel has capabilies enabled and available. Once LSM is enabled the 
capabilities module takes over cap handling. This is why we recommend 
(strongly!) that the capabilities module be enabled with selinux.

Joshua Brindle

--
gentoo-dev@g.o mailing list