Content-Type: text/plain;
  charset="us-ascii"
From: Torsten Foertsch <torsten.foertsch@gmx.net>
To: linux-kernel@vger.kernel.org
Subject: Capabilities question
Date: Thu, 27 Feb 2003 19:38:14 +0100
User-Agent: KMail/1.4.3
MIME-Version: 1.0
Content-Transfer-Encoding: 8BIT
Message-Id: <200302271938.19362.torsten.foertsch@gmx.net>
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1488
Lines: 46

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

what is the right way to get the current capability setting inherited through 
execve()?

My goal is a wrapper program that sets the needed capabilities and then 
execve()s the real program. These capabilities should also be inherited if 
the real program spawns childs via fork/exec.

Is that possible?

I read the appropriate parts of fs/exec.c where 
/*
 * This function is used to produce the new IDs and capabilities
 * from the old ones and the file's capabilities.
 *
 * The formula used for evolving capabilities is:
 *
 *       pI' = pI
 * (***) pP' = (fP & X) | (fI & pI)
 *       pE' = pP' & fE          [NB. fE is 0 or ~0]
 *
 * I=Inheritable, P=Permitted, E=Effective // p=process, f=file
 * ' indicates post-exec(), and X is the global 'cap_bset'.
 *
 */
is implemented. The problem is that fP and fE are either 0 or ~0 depending on 
the current uid or the uid of the file to be executed (if S_ISUID). Thus pP' 
is only masked by cap_bset which is a global constant (0xfffffeff).

Torsten
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE+XlsbwicyCTir8T4RAjaaAJ9dU8E0YWy1fBnf6OdIX0wr7aQQ2gCgwObJ
aSAxVyLvV0n4MN4E84VVERg=
=YE3a
-----END PGP SIGNATURE-----
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/