CAP_LINUX_IMMUTABLE question

CAP_LINUX_IMMUTABLE question

[Sean Hunter]

Hi there

I am currently trying to tie down the capability bounding set on one of my
servers.  CAP_SYS_RAWIO and CAP_SYS_MODULE have been a great success (although
dropping CAP_SYS_RAWIO seems to prevent reading /proc/sys/kernel/cap-bound).

I now want to drop CAP_LINUX_IMMUTABLE, and have (I think) done that.  However,
it seems to make no difference to my ability to set or clear the immutable
attribute.  I tried this on ext2 and ext3 filesystems just to be on the safe
side.

[root@henry /boot]# lcap CAP_LINUX_IMMUTABLE
[root@henry /boot]# lsattr ./vmlinux-2.4.2-2smp
---i--------- ./vmlinux-2.4.2-2smp
[root@henry /boot]# chattr -i ./vmlinux-2.4.2-2smp
[root@henry /boot]# lsattr ./vmlinux-2.4.2-2smp
------------- ./vmlinux-2.4.2-2smp
[root@henry /boot]# chattr +i ./vmlinux-2.4.2-2smp
[root@henry /boot]# lsattr ./vmlinux-2.4.2-2smp
---i--------- ./vmlinux-2.4.2-2smp

I thought that giving up CAP_SYS_RAWIO may have forfeited my ability to drop
any further caps, so I rebooted and dropped CAP_SYS_MODULE and
CAP_LINUX_IMMUTABLE first, just to be on the safe side.  This made no visible
difference.

Am I doing anything obviously dumb?

Sean

Re: CAP_LINUX_IMMUTABLE question

[Andreas Dilger]

Sean Hunter writes:
> I now want to drop CAP_LINUX_IMMUTABLE, and have (I think) done that.
> However, it seems to make no difference to my ability to set or clear
> the immutable attribute.  I tried this on ext2 and ext3 filesystems
> just to be on the safe side.
> 
> [root@henry /boot]# lcap CAP_LINUX_IMMUTABLE
> [root@henry /boot]# lsattr ./vmlinux-2.4.2-2smp
> ---i--------- ./vmlinux-2.4.2-2smp
> [root@henry /boot]# chattr -i ./vmlinux-2.4.2-2smp
> [root@henry /boot]# lsattr ./vmlinux-2.4.2-2smp
> ------------- ./vmlinux-2.4.2-2smp
> [root@henry /boot]# chattr +i ./vmlinux-2.4.2-2smp
> [root@henry /boot]# lsattr ./vmlinux-2.4.2-2smp
> ---i--------- ./vmlinux-2.4.2-2smp

The code that _should_ check this is fs/ext[23]/ioctl.c:EXT[23]_IOC_SETFLAGS,
so you may want to add some debugging there, to see:
1) if you really have dropped CAP_LINUX_IMMUTABLE
2) the logic of the checking is correct

Cheers, Andreas
-- 
Andreas Dilger  \ "If a man ate a pound of pasta and a pound of antipasto,
                 \  would they cancel out, leaving him still hungry?"
http://www-mddsp.enel.ucalgary.ca/People/adilger/               -- Dogbert

CAP_LINUX_IMMUTABLE question

[Aaron Cohen]

CAP_LINUX_IMMUTABLE currently makes it impossible both to chattr +i or
chattr -i.

I think it would be convenient if there was someone to make it only
illegal for chattr -i.  So that I could still make files unchangeable,
while not allowing myself to ever make them changeable again without
the capability.

I'm currently using CAP_LINUX_IMMUTABLE (along with CAP_SYS_RAWIO and
CAP_SYS_MODULE) to make a poor-man's readonly bootable USB key for USB
drives that don't have a physical R/W switch.  (The priviledges are
dropped in my initscripts).

The only problem is that such a USB key isn't able to make a copy of
itself because it can't remove the mutability of files which is a
little inconvenient. :)

I doubt it would be possible to change the semantics for
CAP_LINUX_IMMUTABLE but would it be stupid of me to try to add a
CAP_LINUX_MUTABLE flag that does what I want?

Thanks,
Aaron