10249l1.txt0000664000175400017510000000147311202651252012073 0ustar jillljeditorListing 1. Wrapper to Execute a Program with Unprivileged Root #include #include #include #include #include int main(int argc, char * argv[]) { int i, ret; char *cmd; char **argvp; cap_t cap = cap_get_proc(); int v[CAP_LAST_CAP+1]; if (!cap) return -1; for (i=0; i<=CAP_LAST_CAP; i++) v[i] = i; if (cap_set_flag(cap, CAP_INHERITABLE, CAP_LAST_CAP+1, v, CAP_SET)) return -1; if (cap_set_proc(cap)) return -1; cap_free(cap); ret = prctl(PR_SET_SECUREBITS, 0xf); if (ret) { perror("prctl securebits"); exit(ret); } argvp = &argv[1]; cmd = argvp[0]; ret = execv(cmd, argvp); perror("execv"); return ret; } 10249l2.txt0000664000175400017510000000060411202651320012063 0ustar jillljeditorListing 2. File Capabilities to Empower Partially Privileged Admins /bin/kill:=ei /bin/ls:=ei /bin/cat:=ei /bin/ls:=ei /bin/mv:=ei /bin/touch:=ei /bin/mount:=ei /bin/umount:=ei /bin/vi:=ei /bin/rm:=ei /bin/chgrp:=ei /bin/find:=ei /bin/chmod:=ei /bin/chown:=ei /bin/mkdir:=ei /usr/sbin/useradd:=ei /usr/bin/passwd:=ei /usr/sbin/setcap:cap_setfcap=ei /bin/ping:cap_net_raw=ep /bin/su:=ep 10249l3.txt0000664000175400017510000000035411202651371012074 0ustar jillljeditorListing 3. Script to Apply File Capabilities #!/bin/sh for l in `cat $1`; do fglob=`echo $l | awk -F: '{ print $1 '}` p=`echo $l | awk -F: '{ print $2 '}` for f in `/bin/ls $flglob`; do setcap $p $f done done 10249l4.txt0000664000175400017510000000212311202651441012067 0ustar jillljeditorListing 4. Capabilities Needed to Boot Fedora with Unprivileged Root /sbin/fsck:=ei /sbin/udevd:=ei /sbin/shutdown:=ei /sbin/e2fsck:=ei /sbin/mingetty:cap_chown,cap_dac_override,cap_sys_tty_config+ei /sbin/dhclient:=ei /sbin/reboot:=ei /sbin/fsck.ext3:=ei /sbin/hwclock:cap_sys_time=ei /bin/setfont:cap_sys_admin,cap_sys_resource,cap_sys_tty_config=ei /bin/hostname:cap_sys_admin=ei /bin/loadkeys:cap_sys_admin,cap_sys_resource,cap_sys_tty_config=ei /usr/bin/stat:cap_dac_override,cap_dac_read_search=ei /sbin/rsyslogd:cap_sys_admin,cap_audit_write=ei /bin/login:all=ei /sbin/MAKEDEV:=ei /sbin/auditd:=ei /sbin/auditctl:=ei /sbin/microcode_ctl:=ei /usr/bin/hal-*:=ei /usr/sbin/hald:=ei /usr/libexec/hal*:=ei /sbin/insmod:=ei /sbin/modprobe:=ei /sbin/rmmod:=ei /bin/plymouth:=ei /usr/bin/Xorg:=ei /usr/sbin/gdm-binary:=ei /bin/dbus-daemon:=ei /usr/sbin/avahi-daemon:=ei /usr/bin/sessreg:=ei /sbin/pam_console_apply:=ei /usr/sbin/gpm:=ei /lib/dbus-1/dbus-daemon-launch-helper:=ep /sbin/initctl:=ei /usr/sbin/console-kit-daemon:=ep /usr/sbin/NetworkManager:=ei /usr/libexec/gdm*:=ei /usr/sbin/gdm-binary:=ei opensshd_caps.patch.txt0000664000175400017510000000263011202651111015074 0ustar jillljeditor--- uidswap.c.orig 2008-10-18 21:06:16.000000000 -0400 +++ uidswap.c 2008-10-18 22:00:58.000000000 -0400 @@ -153,12 +153,14 @@ fatal("setuid %u: %.100s", (u_int)uid, strerror(errno)); #endif +#if 0 #ifndef HAVE_CYGWIN /* Try restoration of UID if changed (test clearing of saved uid) */ if (old_uid != uid && (setuid(old_uid) != -1 || seteuid(old_uid) != -1)) fatal("%s: was able to restore old [e]uid", __func__); #endif +#endif /* Verify UID drop was successful */ if (getuid() != uid || geteuid() != uid) { @@ -248,12 +250,14 @@ fatal("setuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); #endif +#if 0 #ifndef HAVE_CYGWIN /* Try restoration of GID if changed (test clearing of saved gid) */ if (old_gid != pw->pw_gid && pw->pw_uid != 0 && (setgid(old_gid) != -1 || setegid(old_gid) != -1)) fatal("%s: was able to restore old [e]gid", __func__); #endif +#endif /* Verify GID drop was successful */ if (getgid() != pw->pw_gid || getegid() != pw->pw_gid) { @@ -262,12 +266,14 @@ (u_int)pw->pw_gid); } +#if 0 #ifndef HAVE_CYGWIN /* Try restoration of UID if changed (test clearing of saved uid) */ if (old_uid != pw->pw_uid && (setuid(old_uid) != -1 || seteuid(old_uid) != -1)) fatal("%s: was able to restore old [e]uid", __func__); #endif +#endif /* Verify UID drop was successful */ if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid) { upstart.patch.txt0000775000175400017510000000372611202651076013771 0ustar jillljeditordiff --git a/init/Makefile b/init/Makefile index db2a6e7..78b96be 100644 --- a/init/Makefile +++ b/init/Makefile @@ -320,7 +320,7 @@ init_SOURCES = \         notify.c notify.h \         cfgfile.c cfgfile.h   -init_LDFLAGS = -static +init_LDFLAGS = -static -lcap  init_LDADD = \         ../upstart/libupstart.la \         ../nih/libnih.la \ diff --git a/init/init b/init/init index f89c341..a10d4ea 100755 Binary files a/init/init and b/init/init differ diff --git a/init/main.c b/init/main.c index 564114d..992967a 100644 --- a/init/main.c +++ b/init/main.c @@ -111,6 +111,35 @@ static NihOption options[] = {         NIH_OPTION_LAST  };   +#include «sys/prctl.h» +#include «sys/capability.h» +#define NCAPS (CAP_LAST_CAP + 1) + +/* + * enter rootless mode + * lock into SECURE_NOROOT and SECURE_ + */ +int locknoroot(void) +{ +       cap_t cap = cap_get_proc(); +       int i; +       cap_value_t v[NCAPS]; + +       if (!cap) return -1; +       /* we want cap_setpcap in pE */ +       v[0] = CAP_SETPCAP; +       if (cap_set_flag(cap, CAP_EFFECTIVE, 1, v, CAP_SET)) +               return -1; +       /* and we want pI filled */ +       for (i=0; i«NCAPS; i++) +               v[i] = i; +       if (cap_set_flag(cap, CAP_INHERITABLE, NCAPS, v, CAP_SET)) +               return -1; +       if (cap_set_proc(cap)) +               return -1; +       cap_free(cap); +       return prctl(PR_SET_SECUREBITS, 0xf); +}    int  main (int   argc, @@ -278,6 +307,10 @@ main (int   argc,                 exit (1);         }   +       /* lock into secure_noroot and secure_nosuid */ +       if (locknoroot()) { +               exit (1); +       }           /* Generate and run the startup event or read the state from the          * init daemon that exec'd us