On Thu, Apr 06, 2006 at 12:01:06PM -0400, Brian Eaton wrote: > Does cap_setuid give a program enough authority to break out of the > AppArmor profile? Not directly, no; however, because a process with this capability can forge credentials over unix domain sockets it is possible that it could entice another process on the system to perform operations on its behalf that the receiving process wouldn't ordinarily allow. And, of course, just granting the capability in our profile language isn't sufficient -- we simply restrict the capabilities that the process may use -- the process would need to receive the cap_setuid bit from some other process in order to be able to use setuid(2), forge credentials, etc. More dangerous to grant would be CAP_SYS_ADMIN, CAP_SYS_MODULE, CAP_SYS_PTRACE, CAP_SYS_RAWIO. Of course you only have to grant these capabilities to processes that require the functionality these capabilities allow -- if you don't need the functionality, then you do not need to grant the capabilities. Thanks
Attachment:
pgpE5Yng718jQ.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/