[trustees] trustees & capabilities together - ugly hack

[Kamil K. <ka...@ka...>]

Hello.
Like many others, I had problem with inability to use 2 lsm modules at
the same time - trustees and capabilities together.
There're many applications which rely on capabilities - in my case I
needed Bind 9 running on system with trustees enabled.
This was very urgent to me, so I had no choice but to patch the kernel.

Please note that my solution is really a hack, not the proper
implementation.
I did the whole thing in 12h, including research on lsm inner workings,
which I know little about, it wasn't properly tested and could crash your server, give everyone root
access or make your microwave explode - you've been warned.
Use this on production server only if you understand those pretty
straight-forward changes and/or you're really pressed against the wall
with this issue.
It's running on 2 of my production servers for a week now without
problems, but there're no guarantees.

There are several approaches to the problem - I choosed attaching trustees
as a secondary module to capabilities module.
This is the least elegant solution, because it involves patching
capabilities module, but is the simplest one to implement(less hooks
to serve - less places to break something).
For permanent solution it'd be better make trustees primary module and
allow attaching capability as secondary - as selinux does.
Maybe the project maintainer will choose this way for official implementation.

Patches against 2.6.14.3 and trustees 3.0 are available here:
http://kamil.eisp.pl/trustees

Patch against trustees module is trivial and just allows it to register as
secondary module.
Most of the code has been ripped from other lsm modules - capability,
selinux etc.
After applying the patches, you must load capability module and then
trustees module - the order is important.
Hope this will help someone.
Regards.
--
Kamil Kaczkowski
ka...@ka...