Messages in this thread Patch in this message |  | | | Date | Thu, 06 Dec 2007 11:01:01 +0900 | | From | KaiGai Kohei <> | | Subject | Re: [PATCH] capabilities: introduce per-process capability bounding set (v10) |
>>> (Thus, the correct check says no 'new' pI bits can be outside cap_bset.)
>> If this condition intends to dominate 'new' pI bits by 'old' pI bits masked
>> with bounding set, we should not apply cap_combine() here.
>> I think applying cap_intersect() is correct for the purpose.
>
> That would have been my first inclination, but Andrew actually
> wanted to be able to keep a pI with bits not in the capability
> bounding set. And it's really not a big problem, since
>
> 1. you can never grow cap_bset
> 2. the capbound.c program just makes sure to call capset
> to take the bit being removed from cap_bset out of
> pI'
> 3. It could be advantageous for some daemon to keep a bit
> in pI which can never be gained through fP but can be
> gained by a child through (fI&pI).
>
> Does that seem reasonable to you?
OK, I got understood the intention of the condition.
It seems to me reasonable policy.
Thanks,
--
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>
This patch fixes incorrect condition added by per-process capability
bounding set patch.
It intends to limit no new pI capabilities outside bounding set.
Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>
commoncap.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- linux-2.6.24-rc3/security/commoncap.c.old 2007-12-06 10:51:48.000000000 +0900
+++ linux-2.6.24-rc3/security/commoncap.c 2007-12-06 10:52:15.000000000 +0900
@@ -119,9 +119,9 @@ int cap_capset_check (struct task_struct
/* incapable of using this inheritable set */
return -EPERM;
}
- if (!!cap_issubset(*inheritable,
- cap_combine(target->cap_inheritable,
- current->cap_bset))) {
+ if (!cap_issubset(*inheritable,
+ cap_combine(target->cap_inheritable,
+ current->cap_bset))) {
/* no new pI capabilities outside bounding set */
return -EPERM;
}
|  |