public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: "K.R. Foley" <kr@cybsft.com>
To: Jens Axboe <axboe@suse.de>
Cc: Luke Kenneth Casson Leighton <lkcl@lkcl.net>,
	linux-kernel@vger.kernel.org
Subject: Re: Bug#274860: Acknowledgement (kernel-image-2.6.8-1-686: CDROM_SEND_PACKET ioctls only work as root)
Date: Mon, 04 Oct 2004 09:16:40 -0500	[thread overview]
Message-ID: <41615B48.904@cybsft.com> (raw)
In-Reply-To: <20041004140145.GY2287@suse.de>

Jens Axboe wrote:
> On Mon, Oct 04 2004, Luke Kenneth Casson Leighton wrote:
> 
>>found it.
>>
>>it's a new piece of kernel code verify_command in
>>drivers/block/scsi_ioctl.c, which checks for the capability
>>CAP_SYS_RAWIO.
>>
>>ah, dammit.
>>
>>for k3b to work, you'd have to install it setuid root, call
>>getcap(), remove all but the necessary capabilities (i.e. don't
>>remove CAP_SYS_RAWIO), do a setfsuid() and setfsgid() and do
>>a setcap().
> 
> 
> it works in 2.6.9-rcX.
> 

I don't know for sure if this is related or not, but it sure sounds like 
it. I have noticed the following in at least the last few versions (I 
believe 2.6.9-rc2 also): Even though CONFIG_SECURITY_CAPABILITIES can be 
configured as a module, if I don't compile it into the kernel getcap and 
setcap fail.

kr

  reply	other threads:[~2004-10-04 14:23 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <E1CES9w-0005Lh-6f@lkcl.net>
     [not found] ` <handler.274860.B.10968930694757.ack@bugs.debian.org>
     [not found]   ` <20041004131014.GF19341@lkcl.net>
2004-10-04 13:53     ` Bug#274860: Acknowledgement (kernel-image-2.6.8-1-686: CDROM_SEND_PACKET ioctls only work as root) Luke Kenneth Casson Leighton
2004-10-04 14:01       ` Jens Axboe
2004-10-04 14:16         ` K.R. Foley [this message]
2004-10-04 14:25         ` Luke Kenneth Casson Leighton
2004-10-04 14:19           ` Jens Axboe

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=41615B48.904@cybsft.com \
    --to=kr@cybsft.com \
    --cc=axboe@suse.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lkcl@lkcl.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox