[lkml]   [1999]   [Apr]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: capabilities in elf headers, (my) final (and shortest) iteration
Hi Alan.

>>> ...and works only for some types of files (how about a webserver
>>> written in Perl?).

>> That's up to the PERL interpreter to handle, not the kernel. After
>> all, the kernel ignores s[gu]id on scripts already, and the only
>> reason s[gu]id works on PERL scripts is because the PERL
>> interpreter handles the relevant capabilities if it sees the
>> s[gu]id flag set on the script it's running.

> Just where do you think the perl interpreter is going to look to
> decide what capabilities to enable? suidperl just stats the
> script and looks at the setuid bits to decide what to do. If the
> capability bits are not in the fs, where will suidcapperl find
> them? There ain't no ELF header in a script.

> Not that I really care one way or the other about capabilities,
> just wondering if anyone has really thought this through before
> posting "it's up to the interpreter"

{Shrug} Perhaps somebody can suggest some way that capabilities can
have meaning for a script, any script if it comes to that?

The best I've seen so far is for any script to require the
capabilities of whichever interpreter it uses, in which case a capable
script would use a different version of the interpreter that included
the capabilities the script needed, and to my way of thinking, such a
scheme is open to abuse...

Personally, I can see NO sensible meaning for attaching capabilities
to a script, at least not from an implementation viewpoint, and until
somebody comes up with a sensible meaning for doing so, I see no point
in even allowing scripts to be given capabilities separate from the
interpreter they use...

Best wishes from Riley.

| There is something frustrating about the quality and speed of Linux |
| development, ie., the quality is too high and the speed is too high, |
| in other words, I can implement this XXXX feature, but I bet someone |
| else has already done so and is just about to release their patch. |

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:51    [W:0.314 / U:0.480 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site