Messages in this thread | | | Date | Wed, 12 May 1999 13:50:39 -0700 (PDT) | From | Y2K <> | Subject | Re: [PATCH] capabilities done right |
| |
On Wed, 12 May 1999, Alexander Kjeldaas wrote: > > +What can elfcap do: > > +* mask inheritable, permitted and effective sets by arbitrary mask > > +* set euid back to ruid ^^^^^^^^^^^^^^^^^^^^^ > If you break ping in the above scheme, you could edit /etc/passwd and > gain access to the whole system. Capabilities doesn't gain you much > if you have to use UID 0. The ping would run as the calling user not as root. That is why "set euid back to ruid" is included. /etc/passwd should probable be not owned by root anymore one could also argue. bin,daemon,operator,sys,wheel and family should be used more and possible be joined with yet others.
-- Any caps I mention are *derived* from a withdrawn draft posix document. See http://www.millenniumproductsllc.com/sjp/ for more info.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |