[lkml]   [1999]   [Apr]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: capabilities in elf headers, (my) final (and shortest) iteration
Hi Riley,

> > Just where do you think the perl interpreter is going to look to
> > decide what capabilities to enable? suidperl just stats the
> > script and looks at the setuid bits to decide what to do. If the
> > capability bits are not in the fs, where will suidcapperl find
> > them? There ain't no ELF header in a script.
> > Not that I really care one way or the other about capabilities,
> > just wondering if anyone has really thought this through before
> > posting "it's up to the interpreter"
> {Shrug} Perhaps somebody can suggest some way that capabilities can
> have meaning for a script, any script if it comes to that?

I was thinking of this; someone mentioned a 'Perl Webserver'. I figured,
the kernel already parses the first line to get the interpreter; why
couldn't it parse the next three #! lines as well, and read in hex encoded
capabilities? (this only if the capability flag is set) The only sensible
thing to do, then, would be to run the interpreter with that set and
ignore the interpreter's set. (possibly an intelligent combination of the
two, but I doubt this is a good idea)

> The best I've seen so far is for any script to require the
> capabilities of whichever interpreter it uses, in which case a capable
> script would use a different version of the interpreter that included
> the capabilities the script needed, and to my way of thinking, such a
> scheme is open to abuse...

Yes, with setuid you only needed one extra flavor. With capabilities,
it's much worse.

> Personally, I can see NO sensible meaning for attaching capabilities
> to a script, at least not from an implementation viewpoint, and until
> somebody comes up with a sensible meaning for doing so, I see no point
> in even allowing scripts to be given capabilities separate from the
> interpreter they use...

Well, the idea here is that the interpreter needs the proper capabilities
to do everthing asked by the script; such as bind to port 80.


- --
David L. Parsley
Network Specialist
City of Salem Schools

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:51    [W:0.071 / U:0.968 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site