lkml.org 
[lkml]   [2009]   [Mar]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: VFS, NFS security bug? Should CAP_MKNOD and CAP_LINUX_IMMUTABLE be added to CAP_FS_MASK?
Quoting J. Bruce Fields (bfields@fieldses.org):
> On Wed, Mar 11, 2009 at 03:53:34PM +0300, Igor Zhbanov wrote:
> > Hello!
> >
> > It seems that CAP_MKNOD and CAP_LINUX_IMMUTABLE were forgotten to be
> > added to CAP_FS_MASK_B0 in linux-2.6.x and to CAP_FS_MASK in
> > linux-2.4.x. Both capabilities affects file system and can be
> > considered file system capabilities.
>
> Sounds right to me--I'd expect rootsquash to guarantee that new device
> nodes can't be created from the network. Cc'ing random people from the
> git log for include/linux/capability.h in hopes they can help.

Yeah it seems reasonable. If it is, then does that mean that we
also need CAP_SYS_ADMIN (to write selinux labels) and CAP_SETFCAP
(to set file capabilities) as well?

-serge


\
 
 \ /
  Last update: 2009-03-12 17:23    [W:0.225 / U:0.112 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site