Messages in this thread | | | Date | Fri, 9 Apr 1999 20:32:44 -0400 (EDT) | From | "Albert D. Cahalan" <> | Subject | Re: caps in elf, next itteration (the hack get's bigger) |
| |
Jonathan Walther writes:
> Please! How the HELL are you going to set the capabilities for shell > scripts if they are dependant on elf format?
Note that we don't allow setuid scripts either. Try it.
> Perl programs.
The interpreter is responsible, just as it is for setuid perl scripts. Remember, the kernel ignores the setuid bit on perl scripts.
Add the desired capabilities to your perl script, using some sort of perl syntax to do it. The perl interpreter will need to check a capability database to see if you are allowed to have such power.
> How about older a.out binaries?
You want old executables to have capabilities? Don't do that. They most likely have well-known security holes. If you really want, add a wrapper.
[snip general panic]
You will mostly like this. It isn't really beautiful, but it is the most usable solution. I want something that Debian can install by default -- and that means an NFS /usr mounted from Irix must work. Without compatibility, distributions will keep using plain setuid root.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |