Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752566Ab1DRPCY (ORCPT ); Mon, 18 Apr 2011 11:02:24 -0400 Received: from mail-ew0-f46.google.com ([209.85.215.46]:46053 "EHLO mail-ew0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751194Ab1DRPCS (ORCPT ); Mon, 18 Apr 2011 11:02:18 -0400 DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=QrrhaEOcOzjdOu4naC6O+Qa+tuouXIt/eoRIFolzwllLXa459Z14CsKXZWG4Ey34Ea UV/oatKwR1ClA/CZ+uGMmFjOPtY1JiO7FYKhAMJhccQi4jx02abmRBnwt2+l7hjLmM79 cJds9IZ1eS21M4xvYPHkFgTFhrsTODJmeqh0k= MIME-Version: 1.0 In-Reply-To: <20110418082838.GA30088@hallyn.com> References: <20110417180722.GA21112@hallyn.com> <20110418082838.GA30088@hallyn.com> Date: Tue, 19 Apr 2011 00:02:17 +0900 Message-ID: Subject: Re: Linux capabilities shouldn't be lost during setuid to non-root from root or to another non-root uid from a non-root uid. From: crocket To: "Serge E. Hallyn" Cc: linux-kernel@vger.kernel.org Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 963 Lines: 25 I have several questions. 1) How do I set SECBIT_NO_SETUID_FIXUP? 2) Is there any reason to unset SECBIT_NO_SETUID_FIXUP by default? On Mon, Apr 18, 2011 at 5:28 PM, Serge E. Hallyn wrote: > Quoting crocket (crockabiscuit@gmail.com): >> I don't like the fact that an application should be linux-specific to >> keep capabilities after setuid. >> If users added capabilities to a file, they would know what they were >> doing, and they would want applications to keep capabilities even >> after setuid. > > Alternatively, you could call the program using a wrapper which first > sets the SECBIT_NO_SETUID_FIXUP securebit, after which setuid would > not trigger any capability changes. > > -serge > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/