* Re: [PATCH] sysctl: allow override of /proc/sys/net with CAP_NET_ADMIN [not found] ` <20080530161857.25e3fbc5@extreme> @ 2008-05-31 1:59 ` Eric W. Biederman 2008-05-31 2:10 ` Stephen Hemminger 0 siblings, 1 reply; 3+ messages in thread From: Eric W. Biederman @ 2008-05-31 1:59 UTC (permalink / raw) To: Stephen Hemminger Cc: akpm, Chris Wright, stephen.hemminger, adobriyan, morgan, xemul, linux-kernel, netdev Stephen Hemminger <shemminger@vyatta.com> writes: > Extend the permission check for networking sysctl's to allow > modification when current process has CAP_NET_ADMIN capability and > is not root. This version uses the until now unused permissions hook > to override the mode value for /proc/sys/net if accessed by a user > with capabilities. Looks reasonable but a little incomplete. Could you modify register_net_sysctl_table to set this attribute? Or alternatively all of the tables registered with register_net_sysctl. Otherwise I this will not affect all of the sysctls under /proc/sys/net. Which appears to be your intent. > Found while working with Quagga. It is impossible to turn forwarding > on/off through the command interface because Quagga uses secure coding > practice of dropping privledges during initialization and only raising > via capabilities when necessary. Since the dameon has reset real/effective > uid after initialization, all attempts to access /proc/sys/net variables > will fail. Eric ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] sysctl: allow override of /proc/sys/net with CAP_NET_ADMIN 2008-05-31 1:59 ` [PATCH] sysctl: allow override of /proc/sys/net with CAP_NET_ADMIN Eric W. Biederman @ 2008-05-31 2:10 ` Stephen Hemminger 2008-05-31 2:29 ` Eric W. Biederman 0 siblings, 1 reply; 3+ messages in thread From: Stephen Hemminger @ 2008-05-31 2:10 UTC (permalink / raw) To: Eric W. Biederman Cc: akpm, Chris Wright, stephen.hemminger, adobriyan, morgan, xemul, linux-kernel, netdev On Fri, 30 May 2008 18:59:26 -0700 ebiederm@xmission.com (Eric W. Biederman) wrote: > Stephen Hemminger <shemminger@vyatta.com> writes: > > > Extend the permission check for networking sysctl's to allow > > modification when current process has CAP_NET_ADMIN capability and > > is not root. This version uses the until now unused permissions hook > > to override the mode value for /proc/sys/net if accessed by a user > > with capabilities. > > Looks reasonable but a little incomplete. > > Could you modify register_net_sysctl_table to set this attribute? > Or alternatively all of the tables registered with register_net_sysctl. > > Otherwise I this will not affect all of the sysctls under > /proc/sys/net. Which appears to be your intent. > > > Found while working with Quagga. It is impossible to turn forwarding > > on/off through the command interface because Quagga uses secure coding > > practice of dropping privledges during initialization and only raising > > via capabilities when necessary. Since the dameon has reset real/effective > > uid after initialization, all attempts to access /proc/sys/net variables > > will fail. > > Eric Unnecessary, it is a property of the root, and there is only one call to register_sysctl_root in the current code, and that registers the net_sysctl_root structure. ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] sysctl: allow override of /proc/sys/net with CAP_NET_ADMIN 2008-05-31 2:10 ` Stephen Hemminger @ 2008-05-31 2:29 ` Eric W. Biederman 0 siblings, 0 replies; 3+ messages in thread From: Eric W. Biederman @ 2008-05-31 2:29 UTC (permalink / raw) To: Stephen Hemminger Cc: akpm, Chris Wright, stephen.hemminger, adobriyan, morgan, xemul, linux-kernel, netdev Stephen Hemminger <shemminger@vyatta.com> writes: > Unnecessary, it is a property of the root, and there is only one call to > register_sysctl_root > in the current code, and that registers the net_sysctl_root structure. Oh right. I was thinking it was a property of the ctl_table_header. My mistake. Then this is essentially the perfect place to put it. Acked-by: "Eric W. Biederman" <ebiederm@xmission.com> Eric ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2008-05-31 2:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <200805292349.m4TNneua029348@imap1.linux-foundation.org>
[not found] ` <20080530161857.25e3fbc5@extreme>
2008-05-31 1:59 ` [PATCH] sysctl: allow override of /proc/sys/net with CAP_NET_ADMIN Eric W. Biederman
2008-05-31 2:10 ` Stephen Hemminger
2008-05-31 2:29 ` Eric W. Biederman
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).