[lkml]   [1999]   [Apr]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Subjectcaps in elf headers: use the sticky bit!
    Hi all,
    Geez, instead of overloading the meaning of 'setuid 0', let's just
    use the sticky bit! I.e., sticky bit==cap flag:

    - To set the cap flag, a user (process) needs CAP_SETFCAP raised, and the
    kernel (besides the normal fs checks) validates the cap headers as well
    for legality. (this also applies to creating files with this flag raised;
    i.e., through a copy operation)
    - While the cap flag is set, the file is immutable, so the file owner
    can't edit the file directly to raise caps.
    - A file that is both setuid root and capability enabled has only those
    capabilities granted in conjuction w/ the headers; if it's only setuid
    root, the kernel can (as a configurable option?) treat it as before and
    raise all caps.

    This can bring us _really_ close to true capabilities support,
    while avoiding the ugly hack of also storing uid + suid bit in the elf


    - --
    David L. Parsley
    Network Specialist
    City of Salem Schools

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:51    [W:0.017 / U:7.664 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site