Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934102AbbBDWBJ (ORCPT ); Wed, 4 Feb 2015 17:01:09 -0500 Received: from resqmta-ch2-07v.sys.comcast.net ([69.252.207.39]:52769 "EHLO resqmta-ch2-07v.sys.comcast.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755347AbbBDWBG (ORCPT ); Wed, 4 Feb 2015 17:01:06 -0500 Date: Wed, 4 Feb 2015 16:01:05 -0600 (CST) From: Christoph Lameter X-X-Sender: cl@gentwo.org To: Andy Lutomirski cc: "Serge E. Hallyn" , "Andrew G. Morgan" , Serge Hallyn , Serge Hallyn , Jonathan Corbet , Aaron Jones , "Ted Ts'o" , LSM List , lkml , Andrew Morton Subject: Re: [RFC] Implement ambient capability set. In-Reply-To: Message-ID: References: <20150204211617.GA20787@mail.hallyn.com> Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1615 Lines: 54 On Wed, 4 Feb 2015, Andy Lutomirski wrote: > >> Christoph, would your code run ok under NNP? > > > > There are still binaries invoked that need more priviledges. Does not > > work. > > What do you mean by "need more privileges"? Are they setuid-root or > do they use fP? Both. > > Well I'd rather have a way to avoid writing a tool. The best would be if > > you could just set some caps and that would do it. > > However this ends up working, I'll add support to setpriv for it, so > you'll be spared writing the tool if that's acceptable. :) Sure. > > __u32 inheritable = caps->inheritable.cap[i]; > > > > /* > > - * pP' = (X & fP) | (pI & fI) > > + * pP' = (fA & fP) | (X & fP) | (pI & fI) > > pA & pP? Ok. > > + else if (rc != -ENODATA) > > + goto out; > > + rc = 0; > > + if (!cap_isclear(current_cred()->cap_ambient)) > > + goto out; > > Confused. What about effective? Don't we still need to address that? Seems that the caps do not take effect unless I set them. Is there a better way to do this? Logic is wrong. It must be if (cap_isclear(..)) goto out > > + return -EPERM; > > I don't see why this is necessary given the change above. I guess I should repost the whole patch. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/