Capsicum Implementation Status

Linux

Kernel Implementation

Kernel patches to add Capsicum support are maintained out-of-tree at https://github.com/google/capsicum-linux. Two rounds of discussion on the Linux Kernel Mailing List (LKML) have occurred, in June and July 2014.

The Capsicum kernel patches are divided into discrete chunks, so that individual pieces of functionality that may be of use elsewhere can be picked up independently. In particular, the following changes may be of wider interest:

• The execveat system call, which is needed to allow an implementation of fexecve that does not rely on the /proc filesystem (which is unavailable in Capsicum capability mode). This was merged in Linux v3.19.
• Capsicum's openat behaviour, where paths that include .. or leading / are disallowed, is made available separately as a new O_BENEATH flag for openat. Discussed on the LKML in November 2014 and March 2015; equivalent behaviour is also being proposed for FreeBSD.
• The export of additional unistd.h-like files that allow access to the system call numbers for all x86 sub-architectures (amd64, i386 and x32) simultaneously. This may help any userspace tools that process system calls in a generic way, such as strace, the audit framework and seccomp-bpf.
• In March 2015, Josh Triplett and Thiago Macieira proposed a new clone4 system call and associated CLONE_FD flag, providing functionality analogous to Capsicum's process descriptors. LKML discussion led to an explicit aim of allowing process descriptor functionality to be implemented in terms of these clonefds. The procdesc-version branch (for versions >= 4.2) is therefore implemented this way.

The capsicum-hooks-version branch is maintained as a patchset against the current upstream kernel that implements Capsicum capabilities and capability mode; the procdesc-version branch implements process descriptors (and is almost completely orthogonal – only a small merge patch is needed to join the two branches). Note that both of these branches are frequently rebased.

A test suite for Capsicum functionality is available at https://github.com/google/capsicum-test. This test suite also includes an initial version of the Capsicum userspace support library libcaprights, and has sample autoconf macros to allow userspace programs to configure support for Capsicum in a way that is portable across Linux and FreeBSD.

Roadmap

In the short term, the Capsicum Linux project is focusing on the following areas.

• Implement process descriptors in terms of clonefds: Re-work the previous draft implementation of process descriptors so that:
  • it is implemented in terms of the clonefd patchset proposed by Josh Triplett and Thiago Macieira
  • the suggested semantics for interactions with existing UNIX functionality are implemented.
• Demonstrate the utility of Capsicum: Although the initial LKML discussions of Capsicum didn't induce any immediate NACKs, there wasn't clear enough support to suggest a near-term merge of the feature. Therefore, we aim to increase support by providing examples of the use of Capsicum in userspace; in particular …
• Implement library remoting with Capsicum: One of the original target use-cases for Capsicum was to make it possible for libraries to provide their interface with an implementation that lives in a separate process. This separate process can be Capsicum-sandboxed, and only provided with the specific capabilities that are needed to perform its function. This allows libraries that are particularly prone to vulnerabilities (such as complex, memory-fiddling media libraries) to be isolated so that vulnerabilities in the library do not affect the application using the library.

When these are done, we aim to re-visit LKML discussion of the kernel changes.

Application Support

An experimental personal package archive for Ubuntu 14.04 is available at pkg.capsicum-linux.org. This PPA includes a pre-built kernel including Capsicum support, together with a few Capsicumized applications (mostly generated by simple adaptations of the equivalent FreeBSD Capsicum support):

• OpenSSH: Updated openssh-server package, adapted from FreeBSD variant.
• tcpdump: Updates trivially adapted from FreeBSD variant.
• strings: The binutils package holds a Capsicumized version of the strings application.