From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mike Kazantsev Subject: Re: POSIX CAP_DAC_READ_SEARCH doesn't bypass file read permissions? Date: Mon, 28 Dec 2009 10:40:54 +0500 Message-ID: <20091228104054.09ddce06@malediction> References: <20091226233012.38d67cf5@coercion> <20091227220610.GA19083@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: "Serge E. Hallyn" To: linux-fsdevel@vger.kernel.org Return-path: Received: from lo.gmane.org ([80.91.229.12]:33946 "EHLO lo.gmane.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750913AbZL1FlW (ORCPT ); Mon, 28 Dec 2009 00:41:22 -0500 Received: from list by lo.gmane.org with local (Exim 4.50) id 1NP8M2-0000zD-Qz for linux-fsdevel@vger.kernel.org; Mon, 28 Dec 2009 06:41:18 +0100 Received: from wall.mplik.ru ([195.58.1.141]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Mon, 28 Dec 2009 06:41:18 +0100 Received: from mk.fraggod by wall.mplik.ru with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Mon, 28 Dec 2009 06:41:18 +0100 In-Reply-To: <20091227220610.GA19083@us.ibm.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Sun, 27 Dec 2009 16:06:10 -0600 "Serge E. Hallyn" wrote: > Quoting Mike Kazantsev (mk.fraggod@gmail.com): ... > > CAP_DAC_READ_SEARCH seem to be well-suited and sufficient for the > > task, according to docs: > > > > Bypass file read permission checks and directory read and execute > > permission checks. > > > > I can see it bypassing directory checks, but it fails to bypass file > > permission check. ... > > To be sure, are you saying that you've tested with CAP_DAC_OVERRIDE > and that works? Are you running with selinux enforcing? > > Note my own test on 2.6.33-rc2-00007-g85d1bb6 succeeds... > Basically, that's what I'm seeing: # uname -a Linux alpharius 2.6.32.2-fg.minion32 #1 SMP Mon Dec 28 09:52:53 YEKT 2009 i686 Genuine Intel(R) CPU T2600 @ 2.16GHz GenuineIntel GNU/Linux # gcc test.c -lcap-ng -o /test # setcap 'cap_dac_read_search=ep' /test # getcap /test test = cap_dac_read_search+ep # touch /root/test{1,2} # chmod 600 /root/test1 # chmod 644 /root/test2 # ls -ld /root/{,test{1,2}} drwx------ 21 root root 4.0K Dec 28 09:21 /root/ -rw------- 1 600 root 0 Dec 28 09:21 /root/test1 -rw-r--r-- 1 644 root 0 Dec 28 09:21 /root/test2 # su -s /bin/zsh nobody % ls -ld /root/{,test{1,2}} ls: cannot access /root/test1: Permission denied ls: cannot access /root/test2: Permission denied drwx------ 21 root root 4.0K Dec 28 09:21 /root/ % /sbin/getcap /test /test = cap_dac_read_search+ep % /test /root/test1 Capability: 1, error: Permission denied % /test /root/test2 Capability: 1, % exit # setcap 'cap_dac_override=ep' /test # su -s /bin/zsh nobody % /sbin/getcap /test /test = cap_dac_override+ep % /test /root/test1 Capability: 0, % /test /root/test2 Capability: 0, Guess your post means that it's not a normal behavior and should work as documented in capabilities(7). No SELinux here, just plain 2.6.32.2 kernel on a KVM machine, 2.6.32.1 yields the same result. Filesystem is ext4, acl support is compiled in, but not enabled. I'm checking out git kernel tree now to test with 2.6.33 and see if I can get it working, and cherry-pick a patch from there, thanks for the suggestion. -- Mike Kazantsev // fraggod.net