Linux Capabilities Bounding Set Support #202

This addition adds a build-time option that's linux specific.

It drops any capabilities assigned to the process at launch time (if it were launched as root, root loses all special meaning). It also removes all capabilities from the binding set and locks all options related to privilege escalation so that they may not be changed.

For these options to work (if built) the binary must be setuid root (horrible) or setcap cap_setpcap+eip bitcoind; (awesome) It only needs this capability so that it can clear the bounding set which it does in main() of bitcoind very first thing. I am not sure where the code needs to go to make it function in bitcoin gui client?

For more details make sure you have libcap2-dev installed and: man 7 capabilities man 2 prctl

The relevant sections of prctl(2) are: PR_CAPBSET_DROP and PR_SET_SECUREBITS.

This patch will make it so that (barring issues in the posix.1e implementation in the kernel itself) any code execution vulnerabilities in the future will be unable to gain escalated privileges through the bitcoind process. Even by exec()'ing suid binaries and exploiting known issues with them.

Forum thread: http://www.bitcoin.org/smf/index.php?topic=7582.0

Now with less USE_UPNP removal.

FYI These are syscalls and system lib deps that shoud be available to any linux distro running 2.6.32+.

Can you create a forum thread about this?

Done: http://www.bitcoin.org/smf/index.php?topic=7582.0

Isn't it possible to use setcap to choose exactly which capabilities shall be kept and which shall be drop ? What's the point of modifying them from bitcoin code ?

I just don't see many other security-related/crypto-related programs using this, and guarding against running as root is really tilting at windmills. There is a long list of dumb things you should not do, such as run wallet software as root, and I think it's low on the priority list, as it does not seem to be a prime attack vector.

This has nothing to do with guarding against running as root. That is just a side effect?!

Also, quite a bit of software uses these mechanisms. For instance: (off the top of my head) bind uses it. The entirety of the priv escalation code in the kernel (setuid binary processing, etc) uses it. The bounding set feature that lets you set a mask of capabilities that can be re-enabled is fairly new but the underlying mechanisms have been in place since 2.4 iirc.

And to answer you sgimenez this code isn't just removing all capabilities. It's setting the capabilities bounding set so that nothing spawned from the bitcoin process can ever re-enable them. See the referenced documentation in the original pull.