[lkml]   [2004]   [Dec]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Is CAP_SYS_ADMIN checked by every program !?

    In message <>
    "Re: Is CAP_SYS_ADMIN checked by every program !?"
    "Kyle Moffett <>" wrote:

    > On Dec 28, 2004, at 23:47, Tetsuo Handa wrote:
    > > It seems to me that every program calls capable(CAP_SYS_ADMIN),
    > Umm, the program has nothing to do with this. Programs themselves have
    > no
    > access to the kernel function "capable". Probably something in the
    > kernel, perhaps
    > triggered by libc or maybe just suid checks, is checking for
    > CAP_SYS_ADMIN. It's
    > harmless and irrelevant, why do you care?

    I'm developing a kernel patch that provides simple and handy
    MAC(mandatory access control) functionality, much easier than SELinux.
    And now I'm porting the patch from 2.4 to 2.6,
    though the patch can't support LSM, for it refers 'struct vfsmount'.

    At first, I doubted that some kernel function (do_execve(), memory management
    functions, or any kernel functions that are always called by every process) is
    doing this CAP_SYS_ADMIN checking. But may be this CAP_SYS_ADMIN checking is
    caused by the Fedora Core 3's libc, not by the kernel.
    I don't have 2.6 kernel environment other than Fedora Core 3.

    But anyway, I have to give up checking for CAP_SYS_ADMIN .

    Thank you.
    Tetsuo Handa
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:09    [W:0.023 / U:11.564 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site