lkml.org 
[lkml]   [2004]   [Dec]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: Is CAP_SYS_ADMIN checked by every program !?
    From
    Date
    Hello,

    Bernd Eckenfels wrote:
    > You can add dump_stack(void) from kernel.h to you patch, since there are not
    > many sources for SYS_ADMIN capabilities checks in the kernel. You will
    > quickly find the syscall in question.

    Oh, this is exactly what I need.

    And the following is the results of these tow lines.
    printk("\n[%s]\n", current->comm);
    dump_stack();

    [ls]
    [<c01e1852>] cap_vm_enough_memory+0x82/0x1f0
    [<c0156dcd>] setup_arg_pages+0x9d/0x230
    [<c0174373>] load_elf_binary+0x473/0xca0
    [<c01334e7>] __alloc_pages+0xa7/0x360
    [<c0156bdd>] copy_strings+0x1dd/0x200
    [<c0157b00>] search_binary_handler+0x50/0x170
    [<c0157d9e>] do_execve+0x17e/0x210
    [<c01010bc>] sys_execve+0x3c/0x80
    [<c010246d>] sysenter_past_esp+0x52/0x75

    [cat]
    [<c01e1852>] cap_vm_enough_memory+0x82/0x1f0
    [<c0156dcd>] setup_arg_pages+0x9d/0x230
    [<c0174373>] load_elf_binary+0x473/0xca0
    [<c01334e7>] __alloc_pages+0xa7/0x360
    [<c0156bdd>] copy_strings+0x1dd/0x200
    [<c0157b00>] search_binary_handler+0x50/0x170
    [<c0157d9e>] do_execve+0x17e/0x210
    [<c01010bc>] sys_execve+0x3c/0x80
    [<c010246d>] sysenter_past_esp+0x52/0x75

    [tcsh]
    [<c01e1852>] cap_vm_enough_memory+0x82/0x1f0
    [<c0112c1e>] copy_mm+0x17e/0x360
    [<c0113686>] copy_process+0x406/0x9c0
    [<c0113d45>] do_fork+0x75/0x1ad
    [<c01e753e>] copy_to_user+0x3e/0x50
    [<c011f85e>] sys_rt_sigprocmask+0xae/0x100
    [<c010103c>] sys_clone+0x3c/0x40
    [<c010246d>] sysenter_past_esp+0x52/0x75

    [sed]
    [<c01e1852>] cap_vm_enough_memory+0x82/0x1f0
    [<c0156dcd>] setup_arg_pages+0x9d/0x230
    [<c0174373>] load_elf_binary+0x473/0xca0
    [<c01334e7>] __alloc_pages+0xa7/0x360
    [<c0156bdd>] copy_strings+0x1dd/0x200
    [<c0157b00>] search_binary_handler+0x50/0x170
    [<c0157d9e>] do_execve+0x17e/0x210
    [<c01010bc>] sys_execve+0x3c/0x80
    [<c010246d>] sysenter_past_esp+0x52/0x75

    [klogd]
    [<c01e179c>] cap_syslog+0x4c/0x80
    [<c011445d>] do_syslog+0x2d/0x380
    [<c0127640>] autoremove_wake_function+0x0/0x60
    [<c011cb84>] update_process_times+0x44/0x50
    [<c0127640>] autoremove_wake_function+0x0/0x60
    [<c014cda6>] vfs_read+0x116/0x160
    [<c014d0b1>] sys_read+0x51/0x80
    [<c010246d>] sysenter_past_esp+0x52/0x75

    The function which calls capable(CAP_SYS_ADMIN) is
    cap_vm_enough_memory() defined in security/commoncap.c ,
    and this function is called whenever sys_execve() is called.
    Therefore, it seemed to me that every program calls capable(CAP_SYS_ADMIN).

    Thank you very much.
    --
    Tetsuo Handa
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 14:09    [W:0.022 / U:180.432 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site