Re: [PATCH] 2.6.15: Filesystem capabilities 0.16

[Olaf Dietsche <olaf+list.linux-kernel@olafdietsche.de>]

Sorry for the late response, I've been away for the week.

Horst von Brand <vonbrand@inf.utfsm.cl> writes:

> Olaf Dietsche <olaf+list.linux-kernel@olafdietsche.de> wrote:
>> +	  For example, you may drop the SUID bit from ping and grant the
>> +	  CAP_NET_RAW capability:
>> +	  # chmod u-s /bin/ping
>> +	  # chcap cap_net_raw=ep /bin/ping
>
> Why the cap_ part? It should be enough to say, e.g.
>
>     chcap net-raw=ep /bin/ping
>
> ('_' has SHIFT, normally... '-' is easier to type)

This is the way libcap expects the capabilities string. I never
questioned the format of this string. But it isn't hard to do a simple
mapping.

>> +
>> +	  Another use would be to run system daemons with their own uid:
>> +	  # chcap cap_net_bind_service=ei /usr/sbin/named
>> +	  This sets the effective and inheritable capabilities of named.
>> +
>> +	  In your startup script:
>> +	  inhcaps cap_net_bind_service=i bind:bind /usr/sbin/named
>
> AFAIU, the =i implies inherited, why another command to set that?

Look for keep_capabilities in security/commoncap.c. If you do a
setuid() away from root, Linux drops all privileges. Inhcaps does a
setuid() and arranges for keeping the needed capabilities.

Regards, Olaf.