[PATCH] policycoreutils: newrole: Fix drop_capabilities().

[PATCH] policycoreutils: newrole: Fix drop_capabilities().

[Mikhail Efremov]

[-- Attachment #1: Type: text/plain, Size: 229 bytes --]

Hello!

The CAP_* constants should not be or'ed, it is the bit numbers.
And grant the access to the audit system too.

P.S. May be someone can look at the commit messages, I'm not sure
about my English.

-- 
WBR, Mikhail Efremov

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-policycoreutils-newrole-Fix-drop_capabilities.patch --]
[-- Type: text/x-patch, Size: 0 bytes --]

Re: [PATCH] policycoreutils: newrole: Fix drop_capabilities().

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/16/2012 08:50 AM, Mikhail Efremov wrote:
> Hello!
> 
> The CAP_* constants should not be or'ed, it is the bit numbers. And
> grant the access to the audit system too.
> 
> P.S. May be someone can look at the commit messages, I'm not sure 
> about my English.
> 


I talked to the developer of libcap-ng  (Steve Grubb) and he stated
that you are correct but "you should use the 'v' version of update
which allows you to update in just 1 library call. The
capabilities should be separated with a comma and to mark the end you
put a -1:"

capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,
CAP_SYS_ADMIN,
CAP_FOWNER, CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_SETPCAP, CAP_AUDIT_WRITE,
- -1);
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk9jQkIACgkQrlYvE4MpobPK7wCfbrheXgQ3P49ztISEAya3OzDM
cAEAoMNEw9qe2+csKVh4Vup5XauG8cXG
=DUox
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH] policycoreutils: newrole: Fix drop_capabilities().

[Mikhail Efremov]

[-- Attachment #1: Type: text/plain, Size: 779 bytes --]

On Fri, 16 Mar 2012 09:38:10 -0400 Daniel J Walsh wrote:
> On 03/16/2012 08:50 AM, Mikhail Efremov wrote:
> > Hello!
> > 
> > The CAP_* constants should not be or'ed, it is the bit numbers. And
> > grant the access to the audit system too.
> 
> I talked to the developer of libcap-ng  (Steve Grubb) and he stated
> that you are correct but "you should use the 'v' version of update
> which allows you to update in just 1 library call. The
> capabilities should be separated with a comma and to mark the end you
> put a -1:"
> 
> capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,
> CAP_SYS_ADMIN,
> CAP_FOWNER, CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_SETPCAP, CAP_AUDIT_WRITE,
> - -1);

Thanks, I didn't notice this function.
Here are updated patches.

-- 
WBR, Mikhail Efremov

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-policycoreutils-newrole-Fix-drop_capabilities.patch --]
[-- Type: text/x-patch, Size: 0 bytes --]

Re: [PATCH] policycoreutils: newrole: Fix drop_capabilities().

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/16/2012 10:30 AM, Mikhail Efremov wrote:
> On Fri, 16 Mar 2012 09:38:10 -0400 Daniel J Walsh wrote:
>> On 03/16/2012 08:50 AM, Mikhail Efremov wrote:
>>> Hello!
>>> 
>>> The CAP_* constants should not be or'ed, it is the bit numbers.
>>> And grant the access to the audit system too.
>> 
>> I talked to the developer of libcap-ng  (Steve Grubb) and he
>> stated that you are correct but "you should use the 'v' version
>> of update which allows you to update in just 1 library call. The 
>> capabilities should be separated with a comma and to mark the end
>> you put a -1:"
>> 
>> capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED, 
>> CAP_SYS_ADMIN, CAP_FOWNER, CAP_CHOWN, CAP_DAC_OVERRIDE,
>> CAP_SETPCAP, CAP_AUDIT_WRITE, - -1);
> 
> Thanks, I didn't notice this function. Here are updated patches.
> 
The other problem I have with newrole is that we probably should not
drop the BOUNDING Set, since after you newrole you should be still
allowed to execute apps that use capabilities.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk9jWJwACgkQrlYvE4MpobO7kACgznmNJ1vLL7gnHQx3Nm6JnFRr
Us4AoK93Sgn1USp9PHWr1CXhOE1LBYVu
=2sw5
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.