lkml.org 
[lkml]   [2000]   [Jul]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectX only needs CAP_SYS_RAWIO to start -- can be disabled after up
From
Date

I just wanted to point out something a lot of people may be missing,
and that is that once X is up and running, it is quite alright to
disable CAP_SYS_RAWIO

k5 /usr/src/lcap-0.0.3 # ./lcap -c -vv CAP_SYS_RAWIO
Current capabilities: 0xFFFFFFFF
17) *CAP_SYS_RAWIO
* = Capability currently allowed
k5 /usr/src/lcap-0.0.3 # ./lcap CAP_SYS_RAWIO
k5 /usr/src/lcap-0.0.3 # ./lcap
Current capabilities: 0xFFFDFFFF
0) *CAP_CHOWN 1) *CAP_DAC_OVERRIDE
2) *CAP_DAC_READ_SEARCH 3) *CAP_FOWNER
4) *CAP_FSETID 5) *CAP_KILL
6) *CAP_SETGID 7) *CAP_SETUID
8) *CAP_SETPCAP 9) *CAP_LINUX_IMMUTABLE
10) *CAP_NET_BIND_SERVICE 11) *CAP_NET_BROADCAST
12) *CAP_NET_ADMIN 13) *CAP_NET_RAW
14) *CAP_IPC_LOCK 15) *CAP_IPC_OWNER
16) *CAP_SYS_MODULE 17) CAP_SYS_RAWIO
18) *CAP_SYS_CHROOT 19) *CAP_SYS_PTRACE
20) *CAP_SYS_PACCT 21) *CAP_SYS_ADMIN
22) *CAP_SYS_BOOT 23) *CAP_SYS_NICE
24) *CAP_SYS_RESOURCE 25) *CAP_SYS_TIME
26) *CAP_SYS_TTY_CONFIG
* = Capabilities currently allowed
k5 /usr/src/lcap-0.0.3 #
[snip]

And X continues to run perfectly.
And then when I try to restart it:

Fatal server error:
xf86EnableIOPorts: Failed to set IOPL for I/O

[snip]

And now, of course, I can no longer start X until a reboot.

Capabilities are a splendid feature which needs to be more widely used
on Linux servers in my opinion. It has the potential to be a very
popular feature if properly applied.

(Just a little fact that people following the security discussion from
afar may have missed because it is not being mentioned.)


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:57    [W:0.048 / U:0.136 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site