core: drop ambient capabilities in user manager #23988
Conversation
|
The inheritable set is also left intact (at least for now). Clearing it renders file capabilities partially useless. Although filecapped binaries can gain permitted and effective capabilities, without inheriting the inheritable set from systemd they won't be able to pass them down (as long as they are capability-dumb i.e. they don't manipulate their capabilities with libcap) to their children, which as of now is possible. Of course, setting AmbientCapabilities in appropriate service files solves the problem, but on working systems using file capabilities migration may be a bit of a pain at least. https://lists.freedesktop.org/archives/systemd-devel/2022-July/048070.html |
|
@yuwata does |
Nice catch. |
src/core/main.c
Outdated
| @@ -2816,6 +2816,10 @@ int main(int argc, char *argv[]) { | |||
| /* clear the kernel timestamp, because we are not PID 1 */ | |||
| kernel_timestamp = DUAL_TIMESTAMP_NULL; | |||
|
|
|||
| /* Clear ambient capabilities, so services do not inherit | |||
| them implicitly. */ | |||
There was a problem hiding this comment.
can you please add the comment you added to the commit msg here, i.e. that dropping the ambient caps doesn't affect the caps effective for the service manager itself, but only what it passes further down. this is important info for the reader of the code.
(btw, we line break at 109chars these days)
poettering
added
the
reviewed/needs-rework 🔨
steelman
force-pushed
the
drop-ambient-caps
branch
2 times, most recently
from
42f75af to
cfab788
Compare
poettering
changed the title
poettering
added
good-to-merge/with-minor-suggestions
and removed
reviewed/needs-rework 🔨
|
can you drop the "RFC" from the commit msg? |
|
lgtm, otherwise |
Ambient capabilities should not be passed implicitly to user services. Dropping them does not affect the permitted and effective sets which are important for the manager itself to operate.
steelman
force-pushed
the
drop-ambient-caps
branch
from
cfab788 to
f56dd99
Compare
|
So actually, I can't use AmbientCapabilities in the user service, which sounds unfortunate, I do want to allow some programs in the service to use some privileges when running as an unprivileged user, specifically podman. |
Neither ambient capabilities should be passed implicitly to user
services. Dropping them does not affect the permitted and effective sets
which are important for the manager itself to operate.