lkml.org 
[lkml]   [1999]   [Apr]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: ext3 to include capabilities?
Stephen C. Tweedie writes:
> Hi,
>
> On Thu, 1 Apr 1999 22:44:20 -0500 (EST), "Albert D. Cahalan"
> <acahalan@cs.uml.edu> said:
>
> > Assuming you don't allow world-writable setuid executables...
>
> > Who can edit the file? root
> > What runs as root? nothing at all
>
> No: in the capabilities world, you _still_ want setuid. You may want
> lpd/lpr etc to be suid to the lp daemon account. You may want bind to
> be suid to its own account. Having large numbers of system daemon
> accounts each with limited access to data files is one of the prime
> mechanisms for reducing the scope of granted privileges, and suid/sgid
> is the main mechanism for crossing those security domains.
>
> You want to be able to give an executable both suid rights to a given
> uid, _plus_ capabilities. You can't overload the suid-root operator to
> mean "trust the binary's capabilities segment" without sacrificing some
> of the power you want from a capabilities system.

There is a distinction between suid-root and suid-others. You can
still have your suid-lp binaries and also overload the meaning of
suid-root.

The headers would have a mask of capabilities to grant, which the
kernel reads if the binary is suid-root, and also a mask of
capabilities to deny, which is always read.

You can then have a suid-root binary with:
grant: CAP_EUID_ROOT
deny: ~CAP_EUID_ROOT

which gives you suid-root with no capabilities.

Regards,

Richard....

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:51    [W:0.050 / U:1.784 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site