Bug 517659

Summary: Changes for lowering capabilities project
Product: [Fedora] Fedora Reporter: Steve Grubb <sgrubb>
Component: gpmAssignee: Nikola Pajkovsky <npajkovs>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: rawhideCC: dhoward, ebenes, npajkovs, pertusus, zprikryl
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-01-11 12:40:07 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 519823    
Description Flags
Patch to drop capabilities none

Description Steve Grubb 2009-08-15 14:55:14 EDT
Created attachment 357546 [details]
Patch to drop capabilities

Description of problem:
As part of the lowering capabilities project, we should drop all unnecessary
capabilities in gpm
Comment 1 Zdenek Prikryl 2009-08-20 04:55:30 EDT
The patch is added in rawhide. Thanks.
Comment 2 Steve Grubb 2009-08-24 08:31:52 EDT
Thanks for applying the patch. I forgot to mention that you need to add a BuildRequires: libcap-ng-devel so configure finds the library. Do you mind re-spinning with the BR added? Thanks.
Comment 3 Eduard Benes 2010-01-08 09:46:27 EST
Patch for this bug had to be actually dropped in gpm-1.20.6-8. Lowering the capabilities as proposed in the patch introduced bug #537724. Current state is that we do not lower the proposed capabilities in gpm.

Brief summary:

SELinux provides -
   allow gpm_t gpm_t : capability { dac_override setuid setpcap sys_admin sys_tty_config } ; 

The patch provides - 

Adding CAP_DAC_OVERRIDE capability to the patch, which unfortunately gives the daemon ability to do almost anything to the system, fixes the bug #537724. 
Therefore it would be useless to confine the gpm in a such way and the patch 
can be dropped. 

Steve, is this correct? Is there anything else we can do for lowering capabilities in gpm?
Comment 4 Steve Grubb 2010-01-08 10:09:57 EST
That is correct. If you allow DAC_OVERRIDE, then gpm can read or write any file on the system and its pointless to protect against anything. Gpm may not be able to directly perform privileged ops like open a raw socket, but it would be able to write a root cron job that would. So, in the threat model I am trying to protect against, DAC_OVERRIDE presents too big of a hole.
Comment 5 Nikola Pajkovsky 2010-01-11 12:40:07 EST
 closing per comments 3,4