Re: POSIX CAP_DAC_READ_SEARCH doesn't bypass file read permissions?

[Mike Kazantsev <mk.fraggod@gmail.com>]

On Sun, 27 Dec 2009 16:06:10 -0600
"Serge E. Hallyn" <serue@us.ibm.com> wrote:

> Quoting Mike Kazantsev (mk.fraggod@gmail.com):
...
> > CAP_DAC_READ_SEARCH seem to be well-suited and sufficient for the
> > task, according to docs:
> > 
> >   Bypass file read permission checks and directory read and execute
> >   permission checks.
> > 
> > I can see it bypassing directory checks, but it fails to bypass file
> > permission check.
...
> 
> To be sure, are you saying that you've tested with CAP_DAC_OVERRIDE
> and that works?  Are you running with selinux enforcing?
> 
> Note my own test on 2.6.33-rc2-00007-g85d1bb6 succeeds...
> 


Basically, that's what I'm seeing:

  # uname -a
  Linux alpharius 2.6.32.2-fg.minion32 #1 SMP Mon Dec 28 09:52:53 YEKT
  2009 i686 Genuine Intel(R) CPU T2600 @ 2.16GHz GenuineIntel GNU/Linux
  
  # gcc test.c -lcap-ng -o /test
  # setcap 'cap_dac_read_search=ep' /test
  
  # getcap /test
  test = cap_dac_read_search+ep
  
  # touch /root/test{1,2}
  # chmod 600 /root/test1
  # chmod 644 /root/test2
  
  # ls -ld /root/{,test{1,2}}
  drwx------ 21 root root 4.0K Dec 28 09:21 /root/
  -rw-------  1  600 root    0 Dec 28 09:21 /root/test1
  -rw-r--r--  1  644 root    0 Dec 28 09:21 /root/test2
  
  # su -s /bin/zsh nobody
  
  % ls -ld /root/{,test{1,2}}
  ls: cannot access /root/test1: Permission denied
  ls: cannot access /root/test2: Permission denied
  drwx------ 21 root root 4.0K Dec 28 09:21 /root/
  
  % /sbin/getcap /test
  /test = cap_dac_read_search+ep
  
  % /test /root/test1
  Capability: 1, error: Permission denied
  
  % /test /root/test2
  Capability: 1,
  
  % exit
  
  # setcap 'cap_dac_override=ep' /test
  # su -s /bin/zsh nobody
  % /sbin/getcap /test
  /test = cap_dac_override+ep
  % /test /root/test1 
  Capability: 0,
  % /test /root/test2
  Capability: 0,


Guess your post means that it's not a normal behavior and should work
as documented in capabilities(7).

No SELinux here, just plain 2.6.32.2 kernel on a KVM machine, 2.6.32.1
yields the same result.
Filesystem is ext4, acl support is compiled in, but not enabled.


I'm checking out git kernel tree now to test with 2.6.33 and see if I
can get it working, and cherry-pick a patch from there, thanks for the
suggestion.


-- 
Mike Kazantsev // fraggod.net