execcap doesn't work.
Long story: Linux capabilities don't really work as POSIX intended them
to work without filesystem support. I am not working on this these days,
although there are some mostly complete patches on kernel.org for old
kernels.
Because of the ambiguity of what setuid() does with the behavior I
discussed in this old email, when combined with certain setuid-0
programs, we had to make the kernel's default policy less like POSIX and
more like the legacy superuser model.
You used to be able to make it work as it did in the examples below by
raising the inheritable set and lowering the cap_bound set (which is
another hack POSIX didn't specify).
In the absence of filesystem support for capabilities, various folk have
come up with their own ways of leveraging the capabilities to implement
some security models. I fear that completing the capability support as
the POSIX draft defines them will break these other approaches.
I hope that helps clarify what you are seeing.
Cheers
Andrew [who isn't subscribed to the kernel mailing list.]
Don Cohen wrote:
> Please cc me in replies.
>
> quoting from message dated 1998/06 to this list from Andrew Morgan
> Subject: Fwd: Re: Capabilities
> ...
> [root@godzilla progs]# ./execcap cap_net_bind_service=i sleep 1000 &
> [1] 600
> [root@godzilla progs]# cat /proc/600/status
> ...
> CapInh: 0000000000000400
> CapPrm: 0000000000000400
> CapEff: 0000000000000400
>
> My corresponding output ends up with
> CapInh: 0000000000000400
> CapPrm: 00000000fffffeff
> CapEff: 00000000fffffeff
>
> I've tried in 2.4.18 and in 2.2.16, both give the same result so
> I guess it's been this way for some time.
>
> The caps seem to be set correctly by execcap but execve resets them.
> Is this intentional?
> If so, how is one now supposed to get the desired effects?
>
>
> What's really weird (can someone explain this?) is that things
> seem to work better under strace:
> strace ./execcap = head <some file root has no permission to read>
> => permission denied
> whereas without the strace it reads the file.
>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Wed Jan 15 2003 - 22:00:51 EST