On Thu, 2021-12-02 at 07:16 +0000, Denis Semakin wrote: > Obviously the main goal by adding new capability was to avoid the > using CAP_SYS_ADMIN (IOW superuser) OK, but as I've said a couple of times now: the check for CAP_SYS_ADMIN doesn't have to be monolithic like this. We have two sets of checks in the kernel: capable(..., CAP_SYS_ADMIN) which is for the global monolithic root like capability and ns_capable(..., CAP_SYS_ADMIN) which is for the owner (possibly unprivileged) of the user namespace. This gives us a way of parsing out admin capabilites into the small subset that the user namespace needs. Patch 16 changed the check from capable to ns_capable, meaning it's no longer the monolithic CAP_SYS_ADMIN. > to manage IMA stuff, that was also about security granularity. It's > good if CAP_MAC_ADMIN will be enough for doing IMA related things > (write policies and extended attributes). To be honest, as long as the check resolves to ns_capable(..., CAP_SYS_<SOMETHING>) I'm not that bothered because the owner of the user namespace will still pass the check. > But for me it's a little bit unclear how to deal with unprivileged > users: assuming there's no CAP_INTEGRITY_ADMIN but CAP_MAC_ADMIN was > set up, so in this case user can control any LSM (seLinux, SMACK, > etc) and IMA (policies, xattrs). What if .. for some systems there > would be some requirements that will allow to touch LSM but do not > change any IMA (integrity) things? A user can set up any IMA policy > (it's about the system integrity), modify IMA related xattrs but it's > forbidden to change seLinux policies and e.g. SMACK labels... May be > it's unreal scenario of course... but I guess it's not 100% > impossible. This is why looking at it as a switch from capable to ns_capable is useful: an ordinary user can assume ns_capable(..., CAP_SYS_ADMIN) powers arbitrarily, so its a significant check on where you can make the switch. James
