[tor-bugs] #8195 [Tor]: tor and capabilities

[Tor Bug Tracker & Wiki]

#8195: tor and capabilities
--------------------------------+-------------------------------------------
 Reporter:  weasel              |          Owner:                    
     Type:  enhancement         |         Status:  needs_revision    
 Priority:  normal              |      Milestone:  Tor: 0.2.5.x-final
Component:  Tor                 |        Version:                    
 Keywords:  tor-relay security  |         Parent:                    
   Points:                      |   Actualpoints:                    
--------------------------------+-------------------------------------------
Changes (by nickm):

  * status:  needs_review => needs_revision


Old description:

> We should figure out what it takes to keep the CAP_NET_BIND_SERVICE
> capability when changing the user away from root, so that we can re-open
> low listening ports later again.

New description:

 We should figure out what it takes to keep the CAP_NET_BIND_SERVICE
 capability when changing the user away from root, so that we can re-open
 low listening ports later again.

--

Comment:

 Quick review, including some possibly stupid questions:

 Needs a changes file.

 Hm. We should add a comment to the config.c change that says that we're
 calling switch_user later on too, so that even if the first switch_id
 doesn't get called, we still change userid.  We should also explain why
 we're trying the switch_id early.

 Is there any way to do this with the supposedly more supposedly portable
 cap_set_proc() and cap_get_proc() interfaces, or will this forever be
 Linux-specific?  The capget/capset manpage implies that the portable
 interface might be preferable.

 On my host at least, the magic thing to include is <linux/capability.h>;
 though the manpage implies that sys/capability.h is supposed to be what
 works.

 Is the ~ in " data.permitted &= ~CAP_TO_MASK(CAP_NET_BIND_SERVICE); "
 correct? It looks like it would leave every capability ''except''
 CAP_NET_BIND_SERVICE.

 Do we need to keep CAP_SETUID and CAP_SETGID so that the switch_id will
 work?  Do we need to drop them afterward?

 Can/should we clear KEEP_CAPS after switching the UID?

 Should we use prctl(PR_SET_SECUREBITS) too to lock down the the
 environment?

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8195#comment:5>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online