4 ms·

No Love for Negative Permissions – DAC/ACL Bypass on Linux

43 points by Deeg9rie9usi 3y ago

gneray 3y ago
"Negative permissions have consistently been regarded as bad practice and often treated as theoretical concept...If you find yourself reliant on them, consider one of the following actions: Restructure your permissions into proper allow rules; this is the most recommended approach." This resonates. Negative permissions can be a real footgun, which is why we are being very surgical on if/where to introduce them at Oso[1] [1] https://www.osohq.com/ https://www.osohq.com/
- NikkiA 3y ago
  They were even generally considered a bad idea back on VMS' ACL system.
  - gdgghhhhh 3y ago
    Funny to see them used as example by a tutorial from Red hat: https://www.redhat.com/sysadmin/linux-access-control-lists https://www.redhat.com/sysadmin/linux-access-control-lists
    - deleted 3y ago
      [deleted]
  - nullindividual 3y ago
    Deny ACLs have come in very handy when the file structure cannot be re-ordered, or you want to prevent a reg key from being changed, etc. Deny is useful!
somat 3y ago
Also known as enumerating badness. Yes it is a terrible way to operate, and should never be used on secure systems. it is reactive(closing the barn door after the horse got away) endless, thankless task. but.... It always feels wrong to preemptively squash creativity. to make rules not saying what people can't do. but only what they can do. You really have to embrace the police state if you only use positive permissions. A koan from /usr/games/fortune "Every program has two purposes -- one for which it was written and another for which it wasn't."
egberts1 3y ago
This is how I feel about systemd's approach of using badness when configuring their ever-growing badness-oriented .service files. Ideally, you should be using goodness (inclusion of privilege) instead. Same goodness things we do with default-deny firewall, and file permission.
- eliaspro 3y ago
  This isn't so much systemd's fault, but more one of POSIX/Linux. Processes aren't spawned without any privileges at all and then get them assigned selectively (thats what's done on Fuchsia/Zircon: https://fuchsia.dev/fuchsia-src/concepts/process/jobs https://fuchsia.dev/fuchsia-src/concepts/process/jobs ), but instead mostly inherit their privileges and resources from their parents.

43 points by Deeg9rie9usi 3y ago

"Negative permissions have consistently been regarded as bad practice and often treated as theoretical concept...If you find yourself reliant on them, consider one of the following actions: Restructure your permissions into proper allow rules; this is the most recommended approach." This resonates. Negative permissions can be a real footgun, which is why we are being very surgical on if/where to introduce them at Oso[1] [1] https://www.osohq.com/ https://www.osohq.com/

NikkiA 3y ago
They were even generally considered a bad idea back on VMS' ACL system.
- gdgghhhhh 3y ago
  Funny to see them used as example by a tutorial from Red hat: https://www.redhat.com/sysadmin/linux-access-control-lists https://www.redhat.com/sysadmin/linux-access-control-lists
  - deleted 3y ago
    [deleted]
- nullindividual 3y ago
  Deny ACLs have come in very handy when the file structure cannot be re-ordered, or you want to prevent a reg key from being changed, etc. Deny is useful!

somat 3y ago

Also known as enumerating badness. Yes it is a terrible way to operate, and should never be used on secure systems. it is reactive(closing the barn door after the horse got away) endless, thankless task. but.... It always feels wrong to preemptively squash creativity. to make rules not saying what people can't do. but only what they can do. You really have to embrace the police state if you only use positive permissions. A koan from /usr/games/fortune "Every program has two purposes -- one for which it was written and another for which it wasn't."

egberts1 3y ago

This is how I feel about systemd's approach of using badness when configuring their ever-growing badness-oriented .service files. Ideally, you should be using goodness (inclusion of privilege) instead. Same goodness things we do with default-deny firewall, and file permission.

eliaspro 3y ago
This isn't so much systemd's fault, but more one of POSIX/Linux. Processes aren't spawned without any privileges at all and then get them assigned selectively (thats what's done on Fuchsia/Zircon: https://fuchsia.dev/fuchsia-src/concepts/process/jobs https://fuchsia.dev/fuchsia-src/concepts/process/jobs ), but instead mostly inherit their privileges and resources from their parents.