From mboxrd@z Thu Jan 1 00:00:00 1970 From: Willy Tarreau Subject: Re: [PATCH 2.4] CAP_FS_MASK: add CAP_LINUX_IMMUTABLE and CAP_MKNOD Date: Thu, 26 Mar 2009 06:29:58 +0100 Message-ID: <20090326052958.GC13146@1wt.eu> References: <20090325173954.GA19299@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20090325173954.GA19299-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org> Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: "Serge E. Hallyn" Cc: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org, Stephen Smalley , Andrew Morgan , linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, lkml , linux-nfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Igor Zhbanov , stable-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org, linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Chris Wright List-Id: linux-api@vger.kernel.org Hello, On Wed, Mar 25, 2009 at 12:39:54PM -0500, Serge E. Hallyn wrote: > When POSIX capabilities were introduced during the 2.1 Linux > cycle, the fs mask, which represents the capabilities which having > fsuid==0 is supposed to grant, did not include CAP_MKNOD and > CAP_LINUX_IMMUTABLE. However, before capabilities the privilege > to call these did in fact depend upon fsuid==0. > > This patch introduces those capabilities into the fsmask, > restoring the old behavior. > > See the thread starting at http://lkml.org/lkml/2009/3/11/157 for > reference. Thanks to Igor and you for fixing this. The impact did not appear obvious to me at first, to be honnest! I'm queuing the patch for next release. BTW, I've noticed your other patch for 2.2.26, but it's not worth wasting time on it, as 2.2 has remained unmaintained for years now and people are really discouraged from using it as many holes have never been fixed there. Cheers, Willy -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 From: Willy Tarreau Subject: Re: [PATCH 2.4] CAP_FS_MASK: add CAP_LINUX_IMMUTABLE and CAP_MKNOD Date: Thu, 26 Mar 2009 06:29:58 +0100 Message-ID: <20090326052958.GC13146@1wt.eu> References: <20090325173954.GA19299@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: mtk.manpages@gmail.com, Stephen Smalley , Andrew Morgan , linux-security-module@vger.kernel.org, lkml , linux-nfs@vger.kernel.org, Igor Zhbanov , stable@kernel.org, linux-api@vger.kernel.org, Chris Wright To: "Serge E. Hallyn" Return-path: In-Reply-To: <20090325173954.GA19299@us.ibm.com> Sender: linux-api-owner@vger.kernel.org List-ID: Hello, On Wed, Mar 25, 2009 at 12:39:54PM -0500, Serge E. Hallyn wrote: > When POSIX capabilities were introduced during the 2.1 Linux > cycle, the fs mask, which represents the capabilities which having > fsuid==0 is supposed to grant, did not include CAP_MKNOD and > CAP_LINUX_IMMUTABLE. However, before capabilities the privilege > to call these did in fact depend upon fsuid==0. > > This patch introduces those capabilities into the fsmask, > restoring the old behavior. > > See the thread starting at http://lkml.org/lkml/2009/3/11/157 for > reference. Thanks to Igor and you for fixing this. The impact did not appear obvious to me at first, to be honnest! I'm queuing the patch for next release. BTW, I've noticed your other patch for 2.2.26, but it's not worth wasting time on it, as 2.2 has remained unmaintained for years now and people are really discouraged from using it as many holes have never been fixed there. Cheers, Willy From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754041AbZCZFjo (ORCPT ); Thu, 26 Mar 2009 01:39:44 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1750824AbZCZFjd (ORCPT ); Thu, 26 Mar 2009 01:39:33 -0400 Received: from 1wt.eu ([62.212.114.60]:1481 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750778AbZCZFjc (ORCPT ); Thu, 26 Mar 2009 01:39:32 -0400 Date: Thu, 26 Mar 2009 06:29:58 +0100 From: Willy Tarreau To: "Serge E. Hallyn" Cc: mtk.manpages@gmail.com, Stephen Smalley , Andrew Morgan , linux-security-module@vger.kernel.org, lkml , linux-nfs@vger.kernel.org, Igor Zhbanov , stable@kernel.org, linux-api@vger.kernel.org, Chris Wright Subject: Re: [PATCH 2.4] CAP_FS_MASK: add CAP_LINUX_IMMUTABLE and CAP_MKNOD Message-ID: <20090326052958.GC13146@1wt.eu> References: <20090325173954.GA19299@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20090325173954.GA19299@us.ibm.com> User-Agent: Mutt/1.5.11 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, On Wed, Mar 25, 2009 at 12:39:54PM -0500, Serge E. Hallyn wrote: > When POSIX capabilities were introduced during the 2.1 Linux > cycle, the fs mask, which represents the capabilities which having > fsuid==0 is supposed to grant, did not include CAP_MKNOD and > CAP_LINUX_IMMUTABLE. However, before capabilities the privilege > to call these did in fact depend upon fsuid==0. > > This patch introduces those capabilities into the fsmask, > restoring the old behavior. > > See the thread starting at http://lkml.org/lkml/2009/3/11/157 for > reference. Thanks to Igor and you for fixing this. The impact did not appear obvious to me at first, to be honnest! I'm queuing the patch for next release. BTW, I've noticed your other patch for 2.2.26, but it's not worth wasting time on it, as 2.2 has remained unmaintained for years now and people are really discouraged from using it as many holes have never been fixed there. Cheers, Willy