lkml.org 
[lkml]   [2007]   [Dec]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] capabilities: introduce per-process capability bounding set (v10)
    Andrew Morgan wrote:
    > -----BEGIN PGP SIGNED MESSAGE-----
    > Hash: SHA1
    >
    > KaiGai Kohei wrote:
    >> Andrew Morgan wrote:
    >>> -----BEGIN PGP SIGNED MESSAGE-----
    >>> Hash: SHA1
    >>>
    >>> KaiGai Kohei wrote:
    >>>>> + if (!!cap_issubset(*inheritable,
    >>>>> + cap_combine(target->cap_inheritable,
    >>>>> + current->cap_bset))) {
    >>>>> + /* no new pI capabilities outside bounding set */
    >>>>> + return -EPERM;
    >>>>> + }
    >>>>>
    >
    >>> Yes, the !! was a bug. The correct check is a single !.
    >> I was in trouble with getting -EPERM at pam_cap.so :-)
    >>
    >>> (Thus, the correct check says no 'new' pI bits can be outside cap_bset.)
    >> If this condition intends to dominate 'new' pI bits by 'old' pI bits masked
    >> with bounding set, we should not apply cap_combine() here.
    >> I think applying cap_intersect() is correct for the purpose.
    >
    > The check is not meant to limit existing pI bits.
    >
    > The check is meant to limit what new bits can be 'added' to pI (in the
    > case that pE & CAP_SETPCAP is true).

    Thanks, I got understood as I wrote in the previous reply.

    BTW, could you tell me your intention about pam_cap.c is implemented
    with pam_sm_authenticate() and pam_sm_setcred()?
    I think it can be done with pam_sm_open_session(), and this approach
    enables to reduce the iteration of reading /etc/security/capability.conf.

    How do you think the idea?
    --
    OSS Platform Development Division, NEC
    KaiGai Kohei <kaigai@ak.jp.nec.com>


    \
     
     \ /
      Last update: 2007-12-06 03:19    [W:3.661 / U:0.124 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site