Bug 463297

Summary:	[LTC 6.0 FEAT] 201315:File Capabilities - Kernel
Product:	Red Hat Enterprise Linux 6	Reporter:	IBM Bug Proxy <bugproxy>
Component:	kernel	Assignee:	Kevin W Monroe <kmonroe>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Martin Jenner <mjenner>
Severity:	high	Docs Contact:
Priority:	high
Version:	6.0	CC:	arozansk, ejratl, notting, peterm, rwheeler
Target Milestone:	alpha	Keywords:	FutureFeature, Reopened
Target Release:	6.0
Hardware:	All
OS:	All
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-09-23 22:05:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	356741, 463296

Description IBM Bug Proxy 2008-09-22 20:40:43 UTC

=Comment: #0=================================================
Emily J. Ratliff <emilyr.com> - 2008-09-16 18:26 EDT
1. Feature Overview:
Feature Id:	[201315]
a. Name of Feature:	File Capabilities - Kernel
b. Feature Description
File capabilities allow an administrator to mark files with POSIX capabilities. When a process is
instantiated from binary, it receives the capabilities with which the on-disk file is marked.
Binaries that would normally require setuid permission can be given only the capabilities required.
The classic example is the ping program. Normally it is setuid because it requires CAP_NET_RAW. With
file capabilities, the binary can be marked on disk as requiring CAP_NET_RAW and no longer needs to
be made setuid. See
http://www.ibm.com/developerworks/library/l-posixcap.html?ca=dgr-lnxw01POSIX-capabilities for more
details. The 2.6.24 version of the kernel or greater is required to pick up from upstream and the
kernel CONFIG_SECURITY_FILE_CAPABILITIES build configuration option needs to be turned on. The
security.capabilities xattr must be supported by target filesystems.

2. Feature Details:
Sponsor:	LTC Security
Architectures:
x86
x86_64
ppc64
s390 native
s390 compat
s390x

Arch Specificity: Purely Common Code
Affects Core Kernel: Yes
Delivery Mechanism: Direct from community
Category:	Security
Request Type:	Kernel - Enhancement from Upstream
d. Upstream Acceptance:	Accepted
Sponsor Priority	1
f. Severity: High
IBM Confidential:	no
Code Contribution:	IBM code
g. Component Version Target:	>= Linux 2.6.24

3. Business Case
Finer grained control over executable capabilities reduces the danger binaries as they no longer
need to be made setuid and only required capabilities can be given to the process. This will
increase customer security and give Linux a competitive advantage over Windows and Solaris.

4. Primary contact at Red Hat: 
John Jarvis
jjarvis

5. Primary contacts at Partner:
Project Management Contact:
Mounir Bsaibes, bsaibes.com, 512-838-1301

Technical contact(s):
George Wilson, gcwilson.com
Serge Hallyn, sergeh.com

IBM Manager:
Bryan Jacobson, bjacobson.com

Comment 1 Bill Nottingham 2008-10-01 21:22:58 UTC

RHEL 6 will include a kernel later than 2.6.24, this should not be an issue.

Comment 2 Bill Nottingham 2008-10-02 02:09:48 UTC

The feature requested has already been accepted into the upstream code base
planned for the next major release of Red Hat Enterprise Linux.

When the next milestone release of Red Hat Enterprise Linux 6 is available,
please verify that the feature requested is present and functioning as
desired.

Comment 3 IBM Bug Proxy 2009-03-02 22:40:54 UTC

File capabilities are upstream since long before 2.6.29.  They are
enabled in all recent fedoras.  They do require

CONFIG_SECURITY_FILE_CAPABILITIES=y

Comment 4 Kevin W Monroe 2009-09-23 22:05:19 UTC

Closing - included in Red Hat Enterprise Linux 6.

Comment 5 IBM Bug Proxy 2010-05-20 13:21:43 UTC

------- Comment From sergeh.com 2010-05-20 09:10 EDT-------
FWIW, both manual tests and the ltp filecaps testcase pass on RHEL6 on ppc64.  Use of
cap_sys_admin+ie (for user with inheritable capabilties, cap_sys_admin+pe, and file
capabilities plus setuid-root were hand-tested.

All appears correct.