Willy Tarreau <[email protected]> writes: > The use of automated tools to find bugs in random locations of the kernel > induces a raise of security reports even if most of them should just be > reported as regular bugs. This patch is an attempt at drawing a line > between what qualifies as a security bug and what does not, hoping to > improve the situation and ease decision on the reporter's side. > > It defers the enumeration to a new file, threat-model.rst, that tries > to enumerate various classes of issues that are and are not security > bugs. This should permit to more easily update this file for various > subsystem-specific rules without having to revisit the security bug > reporting guide.
One thing here: [...] > +* **Capability-based protection**: > + > + * users not having the ``CAP_SYS_ADMIN`` capability may not alter the > + kernel's configuration, memory nor state, change other users' view of the > + file system layout, grant any user capabilities they do not have, nor > + affect the system's availability (shutdown, reboot, panic, hang, or > making > + the system unresponsive via unbounded resource exhaustion). That is pretty demonstrably not true, and will likely elicit challenges at some point. There are a lot of "make me root" capabilities that enable users to do all of those things; consider CAP_DAC_OVERRIDE as an obvious example. I think that just about all of the capabilities will enable at least one of those things - that's why the capabilities exist in the first place. So I think this needs to be written far more generally. As a lower-priority thing, lockdown mode is meant to at least try to provide some stronger guarantees, and lockdown circumvention seems to be normally be viewed as a security bug. Worth a mention? Thanks, jon
