Re: SG_IO permissions

[KELEMEN Peter <Peter.Kelemen@cern.ch>]

* Arne Wiebalck (arne.wiebalck@cern.ch) [20080702 20:40]:

> The user process in my case is forked by another process which
> runs as root. But since this process does not have CAP_SETPCAP
> it cannot set the child's capabilities (which is how I naively
> thought one could implement this).

There is no need.  Your problem is that setuid() clears the
permissible capability set.  This should do the trick:

	/* ...in child after fork()... */
	prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
	setuid(...);
	cap_set_proc(cap_from_text("cap_sys_rawio+ep"));

HTH,
Peter

-- 
    .+'''+.         .+'''+.         .+'''+.         .+'''+.         .+''
 Kelemen Péter     /       \       /       \     Peter.Kelemen@cern.ch
.+'         `+...+'         `+...+'         `+...+'         `+...+'
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html