[OE-core] [PATCH 0/3] replace suid with capabilities, for example in busybox
Patrick Ohly
patrick.ohly at intel.com
Wed Dec 9 19:14:28 UTC 2015
I started working on hardening a distro by replacing suid binaries
with executables that add only the necessary capabilities via file
capabilities. It is understood that this is often still a path
towards privilege escalation (see
https://forums.grsecurity.net/viewtopic.php?f=7&t=2522&sid=c6fbcf62fd5d3472562540a7e608ce4e#p10271)
but as part of a defense-in-depth strategy it's still useful.
I'd like to get the first two patches reviewed and, if seen as useful,
merged into master.
The busybox_%.bbappend is just an example how this would be used. It's
not meant to be merged.
There's currently one caveat: the file capabilities do not get copied
into images. I see them under pseudo (with getcap, filecap and as
security.capability xattr with getfattr), but they do not get copied
into an ext4 image by mkfs.ext4.
Robert, I tried that with the patched e2fsprogs from meta-selinux. Is
that perhaps something you can look into as part of
https://bugzilla.yoctoproject.org/show_bug.cgi?id=8622 ?
Actually, I just noticed another problem with that e2fsprogs version:
with Smack enabled via meta-intel-iot-security/meta-security-smack,
/etc has under pseudo:
# getfattr -d -m . rootfs/etc/
# file: ../rootfs/etc/
security.SMACK64="System::Shared"
security.SMACK64TRANSMUTE="TRUE"
A loop-mounted ext4 image only has one xattr:
security.SMACK64TRANSMUTE="TRUE"
The following changes since commit 192da885e92d3b163b9c4e6b8151c9ecc6062b14:
build-appliance-image: Update to master head revision (2015-12-09 08:49:13 +0000)
are available in the git repository at:
git://github.com/pohly/openembedded-core capabilities
https://github.com/pohly/openembedded-core/tree/capabilities
Patrick Ohly (3):
capabilities.bbclass: add file capabilities automatically
busybox.inc: prepare for additional link files
busybox_%.bbappend: run ping and traceroute with file capabilities
meta/classes/capabilities.bbclass | 58 ++++++++++++++++++++++++++++
meta/recipes-core/busybox/busybox.inc | 16 ++++----
meta/recipes-core/busybox/busybox_%.bbappend | 41 ++++++++++++++++++++
3 files changed, 108 insertions(+), 7 deletions(-)
create mode 100644 meta/classes/capabilities.bbclass
create mode 100644 meta/recipes-core/busybox/busybox_%.bbappend
--
2.1.4
More information about the Openembedded-core
mailing list