[lkml]   [1999]   [Apr]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: capabilities in elf headers, (my) final (and shortest) iteration
    Hi Alan.

    >>> ...and works only for some types of files (how about a webserver
    >>> written in Perl?).

    >> That's up to the PERL interpreter to handle, not the kernel. After
    >> all, the kernel ignores s[gu]id on scripts already, and the only
    >> reason s[gu]id works on PERL scripts is because the PERL
    >> interpreter handles the relevant capabilities if it sees the
    >> s[gu]id flag set on the script it's running.

    > Just where do you think the perl interpreter is going to look to
    > decide what capabilities to enable? suidperl just stats the
    > script and looks at the setuid bits to decide what to do. If the
    > capability bits are not in the fs, where will suidcapperl find
    > them? There ain't no ELF header in a script.

    > Not that I really care one way or the other about capabilities,
    > just wondering if anyone has really thought this through before
    > posting "it's up to the interpreter"

    {Shrug} Perhaps somebody can suggest some way that capabilities can
    have meaning for a script, any script if it comes to that?

    The best I've seen so far is for any script to require the
    capabilities of whichever interpreter it uses, in which case a capable
    script would use a different version of the interpreter that included
    the capabilities the script needed, and to my way of thinking, such a
    scheme is open to abuse...

    Personally, I can see NO sensible meaning for attaching capabilities
    to a script, at least not from an implementation viewpoint, and until
    somebody comes up with a sensible meaning for doing so, I see no point
    in even allowing scripts to be given capabilities separate from the
    interpreter they use...

    Best wishes from Riley.

    | There is something frustrating about the quality and speed of Linux |
    | development, ie., the quality is too high and the speed is too high, |
    | in other words, I can implement this XXXX feature, but I bet someone |
    | else has already done so and is just about to release their patch. |

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:51    [W:0.020 / U:90.692 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site