I started working on hardening a distro by replacing suid binaries with executables that add only the necessary capabilities via file capabilities. It is understood that this is often still a path towards privilege escalation (see https://forums.grsecurity.net/viewtopic.php?f=7&t=2522&sid=c6fbcf62fd5d3472562540a7e608ce4e#p10271) but as part of a defense-in-depth strategy it's still useful.
I'd like to get the first two patches reviewed and, if seen as useful, merged into master. The busybox_%.bbappend is just an example how this would be used. It's not meant to be merged. There's currently one caveat: the file capabilities do not get copied into images. I see them under pseudo (with getcap, filecap and as security.capability xattr with getfattr), but they do not get copied into an ext4 image by mkfs.ext4. Robert, I tried that with the patched e2fsprogs from meta-selinux. Is that perhaps something you can look into as part of https://bugzilla.yoctoproject.org/show_bug.cgi?id=8622 ? Actually, I just noticed another problem with that e2fsprogs version: with Smack enabled via meta-intel-iot-security/meta-security-smack, /etc has under pseudo: # getfattr -d -m . rootfs/etc/ # file: ../rootfs/etc/ security.SMACK64="System::Shared" security.SMACK64TRANSMUTE="TRUE" A loop-mounted ext4 image only has one xattr: security.SMACK64TRANSMUTE="TRUE" The following changes since commit 192da885e92d3b163b9c4e6b8151c9ecc6062b14: build-appliance-image: Update to master head revision (2015-12-09 08:49:13 +0000) are available in the git repository at: git://github.com/pohly/openembedded-core capabilities https://github.com/pohly/openembedded-core/tree/capabilities Patrick Ohly (3): capabilities.bbclass: add file capabilities automatically busybox.inc: prepare for additional link files busybox_%.bbappend: run ping and traceroute with file capabilities meta/classes/capabilities.bbclass | 58 ++++++++++++++++++++++++++++ meta/recipes-core/busybox/busybox.inc | 16 ++++---- meta/recipes-core/busybox/busybox_%.bbappend | 41 ++++++++++++++++++++ 3 files changed, 108 insertions(+), 7 deletions(-) create mode 100644 meta/classes/capabilities.bbclass create mode 100644 meta/recipes-core/busybox/busybox_%.bbappend -- 2.1.4 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
