Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Further restriction of child processes capabilities (part 1) #7685

Closed
wants to merge 5 commits into from
Closed

Further restriction of child processes capabilities (part 1) #7685

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f341889
SPEC: untie capabilities of different binaries
alexey-tikhonov Nov 7, 2024
a210312
LDAP_CHILD: replace 'cap_dac_override' with 'cap_dac_read_search'
alexey-tikhonov Nov 7, 2024
3763b6e
LDAP_CHILD: don't require any capabilities besides 'cap_dac_read_search'
alexey-tikhonov Nov 8, 2024
dcb52ab
LDAP_CHILD: require only 'cap_dac_read_search=permitted'
alexey-tikhonov Nov 8, 2024
618941b
Describe current capabilities usage.
alexey-tikhonov Nov 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 12 additions & 4 deletions Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,15 @@ ifp_systemdservice = SystemdService=sssd-ifp.service
condconfigexists = ConditionPathExists=\|/etc/sssd/sssd.conf\nConditionDirectoryNotEmpty=\|/etc/sssd/conf.d/

# Bounding set needs to list capabilities required by ldap/krb5/selinux_childs and sssd_pam, otherwise they can't gain it.
# Capabilities usage by binaries:
# - 'ldap_child': read keytab (dac_read_search)
# - 'krb5_child':
# - store TGT for a given user (set*id);
# - create path components of DIR:/FILE: cache, for example: /run/user/$UID (dac_override, chown)
# - read keytab (dac_read_search could be enough but dac_override due to above)
# If system doesn't need to support DIR:/FILE: then 'cap_chown' can be stripped and 'cap_dac_override' replaced with 'dac_read_search'
# - 'selinux_child': currently chown, dac_override, set*id -- to be narrowed
# - 'sssd_pam': read keytab in gss ops (dac_read_search)
capabilities = CapabilityBoundingSet= CAP_CHOWN CAP_DAC_OVERRIDE CAP_SETGID CAP_SETUID CAP_DAC_READ_SEARCH

if BUILD_CONF_SERVICE_USER_SUPPORT
Expand Down Expand Up @@ -5569,14 +5578,13 @@ else
$(MKDIR_P) $(DESTDIR)$(initdir)
endif

CHILD_CAPABILITIES="cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep"
if SSSD_USER
-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/ldap_child
chmod 750 $(DESTDIR)$(sssdlibexecdir)/ldap_child
-$(SETCAP) $(CHILD_CAPABILITIES) $(DESTDIR)$(sssdlibexecdir)/ldap_child
-$(SETCAP) cap_dac_read_search=p $(DESTDIR)$(sssdlibexecdir)/ldap_child
-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/krb5_child
chmod 750 $(DESTDIR)$(sssdlibexecdir)/krb5_child
-$(SETCAP) $(CHILD_CAPABILITIES) $(DESTDIR)$(sssdlibexecdir)/krb5_child
-$(SETCAP) cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/krb5_child
-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/proxy_child
chmod 750 $(DESTDIR)$(sssdlibexecdir)/proxy_child
-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/sssd_pam
Expand All @@ -5585,7 +5593,7 @@ if SSSD_USER
if BUILD_SELINUX
-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/selinux_child
chmod 750 $(DESTDIR)$(sssdlibexecdir)/selinux_child
-$(SETCAP) $(CHILD_CAPABILITIES) $(DESTDIR)$(sssdlibexecdir)/selinux_child
-$(SETCAP) cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/selinux_child
endif
endif

Expand Down
9 changes: 3 additions & 6 deletions contrib/sssd.spec.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,6 @@
%global use_sysusers 0
%endif

# Capabilities of privileged child helpers (required even if SSSD runs under root)
%global child_capabilities cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep

%if 0%{?fedora} >= 35 || 0%{?rhel} >= 9
%global build_subid 1
%else
Expand Down Expand Up @@ -916,8 +913,8 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
%files krb5-common
%license COPYING
%attr(775,%{sssd_user},%{sssd_user}) %dir %{pubconfpath}/krb5.include.d
%attr(0750,root,%{sssd_user}) %caps(%{child_capabilities}) %{_libexecdir}/%{servicename}/ldap_child
%attr(0750,root,%{sssd_user}) %caps(%{child_capabilities}) %{_libexecdir}/%{servicename}/krb5_child
%attr(0750,root,%{sssd_user}) %caps(cap_dac_read_search=p) %{_libexecdir}/%{servicename}/ldap_child
%attr(0750,root,%{sssd_user}) %caps(cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/krb5_child

%files krb5 -f sssd_krb5.lang
%license COPYING
Expand All @@ -935,7 +932,7 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
%license COPYING
%attr(770,%{sssd_user},%{sssd_user}) %dir %{keytabdir}
%{_libdir}/%{name}/libsss_ipa.so
%attr(0750,root,%{sssd_user}) %caps(%{child_capabilities}) %{_libexecdir}/%{servicename}/selinux_child
%attr(0750,root,%{sssd_user}) %caps(cap_chown,cap_dac_override,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/selinux_child
%{_mandir}/man5/sssd-ipa.5*

%files ad -f sssd_ad.lang
Expand Down
6 changes: 4 additions & 2 deletions src/providers/ldap/ldap_child.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -891,8 +891,10 @@ static krb5_error_code privileged_krb5_setup(struct input_buffer *ibuf)
}
DEBUG(SSSDBG_TRACE_INTERNAL, "Kerberos context initialized\n");

sss_set_cap_effective(CAP_DAC_READ_SEARCH, true);
kerr = copy_keytab_into_memory(ibuf, ibuf->context, ibuf->keytab_name,
&keytab_name, NULL);
sss_drop_all_caps();
if (kerr != 0) {
DEBUG(SSSDBG_OP_FAILURE, "copy_keytab_into_memory failed.\n");
return kerr;
Expand All @@ -911,10 +913,12 @@ static errno_t handle_select_principal(TALLOC_CTX *mem_ctx,
char *sasl_primary = NULL;
char *sasl_realm = NULL;

sss_set_cap_effective(CAP_DAC_READ_SEARCH, true);
ret = select_principal_from_keytab(mem_ctx,
ibuf->princ_str, ibuf->realm_str,
ibuf->keytab_name,
NULL, &sasl_primary, &sasl_realm);
sss_drop_all_caps();
if (ret != 0) {
DEBUG(SSSDBG_CRIT_FAILURE, "select_principal_from_keytab() failed\n");
return ret;
Expand Down Expand Up @@ -946,8 +950,6 @@ static errno_t handle_get_tgt(TALLOC_CTX *mem_ctx,

DEBUG(SSSDBG_TRACE_INTERNAL, "Kerberos context initialized\n");

sss_drop_all_caps();

DEBUG(SSSDBG_TRACE_INTERNAL,
"Running as [%"SPRIuid"][%"SPRIgid"].\n", geteuid(), getegid());

Expand Down
Loading