Hi Charles,
thanks for the report. Interesting. I just downloaded the wireshark
source and as I suspected it's using capabilities. The problem then is
that the helper starts as setuid root, sets just the capabilities it
needs, then changes back to it's original userid. It's actually what
we'd like people to be doing. But they then rely upon the traditional
setuid behavior of the unprivileged process being able to kill the
privileged one. This is why checking suid instead of euid at
cap_task_kill() works for you.
Two quick fixes for you right now (apart from the one you've already
got :) would be
1. give wireshark cap_kill, by doing something like
capset cap_kill=ep /bin/wireshark
2. compile a kernel with SECURITY_FILE_CAPABILITIES=n
Andrew, this pretty much was bound to happen... we need to figure out
what our approach here should be. My preference is still to allow
signals when p->uid==current->uid so long as !SECURE_NOROOT. Then as
people start using secure_noroot process trees they at least must know
what they're asking for.
An alternative stance is to accept these things as they come up and try
to quickly work with the authors of such programs to work around it. I
suppose in a security sense that's the superior way :) But it also
seems likely to lead to most people choosing option 2 above and not
bothering to fix the problem.
thanks,
-serge
--
