Re: [PATCH][RFC] 2.5.44 (1/2): Filesystem capabilities kernel patch

[Andreas Gruenbacher <agruen@suse.de>]

On Tuesday 29 October 2002 12:09, Olaf Dietsche wrote:
> Andreas Gruenbacher <agruen@suse.de> writes:
> > A perhaps unrelated note: We once had Pavel Machek's elfcap
> > implementation, in which capabilities were stored in ELF. This was a bad
> > idea because being able to create executables does not imply the user is
> > capable of CAP_SETFCAP, and users shouldn't be able to freely choose
> > their capabilities :-] We still want
>
> I remember this hack and since I hear this claim every now and then, I
> downloaded his patch and verified with the source. Pavel's capability
> patch was about _restricting_ not granting capabilities, so it's more
> like an inheritable, rather than a permitted, set.
>
> At least that was his intention. I didn't verify this with the
> appropriate kernel sources from 1999.

I forgot to CC Pavel the last time. Elfcap probably truly was restrictive 
only. This is comparable to dropping capabilities very early in the suid root 
binaries themselves, and thus not a significant improvement.

We want to be able to also grant capabilities (not only restrict them), so we 
may have fewer suid root binaries.

--Andreas.