Messages in this thread | | | Date | Thu, 12 Mar 2009 11:10:47 -0500 | From | "Serge E. Hallyn" <> | Subject | Re: VFS, NFS security bug? Should CAP_MKNOD and CAP_LINUX_IMMUTABLE be added to CAP_FS_MASK? |
| |
Quoting J. Bruce Fields (bfields@fieldses.org): > On Wed, Mar 11, 2009 at 03:53:34PM +0300, Igor Zhbanov wrote: > > Hello! > > > > It seems that CAP_MKNOD and CAP_LINUX_IMMUTABLE were forgotten to be > > added to CAP_FS_MASK_B0 in linux-2.6.x and to CAP_FS_MASK in > > linux-2.4.x. Both capabilities affects file system and can be > > considered file system capabilities. > > Sounds right to me--I'd expect rootsquash to guarantee that new device > nodes can't be created from the network. Cc'ing random people from the > git log for include/linux/capability.h in hopes they can help.
Yeah it seems reasonable. If it is, then does that mean that we also need CAP_SYS_ADMIN (to write selinux labels) and CAP_SETFCAP (to set file capabilities) as well?
-serge
| |