In Irix the su command has a -C option which allows a user to
request capabilities. We chose an option to su over a new command
because there are cases where you want to change both the uid
and the capabilities at the same time. Resonable restrictions
apply.
> I was thinking to have a file (maybe /etc/caps) that would
> look like the password file but explains what caps that user
> has. for example:
>
> root:SYSADMIN,NETRAW,etc...
> myuser:NETRAW...
In Irix we use /etc/capability. The format is:
<user>:<default-set>:<maximum-set>
casey:all=:all=eip
In this case casey (Hey! That's me!) has the highly recommended
empty set by default, but can request anything he (bwaa haa haa)
wants.
> These users could then use the scap program to get these
> capabilities when they need them. This could either be done
> by scap spawning a shell with the new capability or using
> CAP_SETPCAP to change the capabilities of its parent.
In Irix:
anchovy% su casey -C CAP_DAC_WRITE+eip
anchovy% id -P
uid=4020(casey) gid=10(nuucp) capability=(all= CAP_DAC_WRITE+eip)
anchovy% su casey -C all= -c "id -P"
uid=4020(casey) gid=10(nuucp) capability=(all=)
anchovy%
> Similarly, I'd like to be able to assign capabilities to groups.
> I still need to think of a good example.
Igg. I don't like the idea, but can't really counter it.
> I think I'd also want meta-capabilities. For example 'netmanager'
> which would have all the network related capabilities. Then you
> could say: addcap joe netmanager -- and they would have all the
> rights attached to that.
Capabilities don't map well to roles. We tried. On Irix we
have one role defined (the auditor) with a reasonable set,
but even something simple like adding a user requires quite
a lot of privilege (not necessarily capabilities, but you
do need to be able to modify root owned things).
The purist in me doesn't like the meta-capability notion because
it could inspire lazy granting of capabilities. If one knows that
netmanager is good enough, one might run with capabilities that
are included in netmanager even though they're not needed for the
job at hand. Example: the /etc/netgroup file can be changed without
CAP_PRIV_PORT.
--Casey Schaufler voice: (650) 933-1634 casey@sgi.com fax: (650) 933-0170
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/