Re: ACL Question: normal user howto restrict root's permition ?

* gangxu ([email protected]) wrote:
> locahost:~# lcap CAP_DAC_OVERRIDE
> locahost:~# lcap
> Current capabilities: 0xFFFFFEFD
>    0) *CAP_CHOWN                   1)  *CAP_DAC_OVERRIDE*
>    2) *CAP_DAC_READ_SEARCH         3) *CAP_FOWNER
>    4) *CAP_FSETID                  5) *CAP_KILL
<snip>
> locahost:~# cat /tmp/test
> 123
> 
> I take away the *CAP_DAC_OVERRIDE*, but root can read the file still.

Yeah, sorry, CAP_DAC_READ_SEARCH allows reading files and and
reading/searching directories.

> then I take away the *CAP_DAC_READ_SEARCH*, result is The root can't 
> read the /tmp/test,
> but can write /tmp/test still.........

How are you writing to it?  You will most likely still be able to remove
the file, then recreate it becuase root typically owns /tmp.

> Should I set another CAP to restrict root's write permition?

No, I believe a basic write is protected via CAP_DAC_OVERRIDE.  Of course,
if you still have CAP_FOWNER, then root can simply chmod the file and
write to it.  And if you still have CAP_CHOWN, then root can simply
chown the file and write to it.  And if you still have CAP_SETUID,
then root can simply setuid to the owner of the file and write to it.
If you have CAP_SYS_ADMIN, then root can simply bind mount over the file
with a file of it's choice.  And root still likely has write access to
the block device the file is on, can install kernel modules, and write
directly to kernel memory.  In other words, this seemingly simple task
gets more difficult depending on the sophistication of the attacker.
Capabilities are much better suited at granting unprivileged users
privilege than taking privileges away from root.

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net
_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel